We recently discovered a vulnerability in Blogifier.net v2.3 that allows for unauthenticated remote code execution.

Timeline

Date Action
5/08/2019 Vulnerability discovered by Security401.
5/09/2019 Vulnerability reported to the vendor.
5/11/2019 Issue patched by the vendor.

Fix

The issue was fixed here, but please be sure to use the latest version as additional fixes have been made since this issue was discovered.

Background

Blogifier is an open source blog written in .NET Core and the suggested replacement for BlogEngine.NET.

Technical Details

The assets controller exposes a couple of endpoints that allow uploading and deleting files on the server. The endpoints below are vulnerable to path traversals, allowing an unauthenticated attacker to delete or upload files outside of the intended directories. If the application is run with elevated privileges, the damage can be significant. 

POST	/api/assets/upload
DELETE	/api/assets/remove

Reproduction Steps

The path traversal vulnerability for these endpoints can be reproduced with the commands below:

curl -i -s -k -X $'DELETE' $'http://localhost/api/assets/remove?url=../shell.txt'
curl -X POST "http://localhost/api/assets/upload" \
-F 'files=@webshell.cshtml; filename=../../../webshell.cshtml'

Remote Code Execution

Depending on permissions, it is possible to overwrite an existing cshtml file to achieve code execution. In our testing, we were able to overwrite the Login.cshtml file with a slightly modified version and get a reverse shell.