Overview
Monitorr is a simple web application that allows you to setup a dashboard to monitor various website / web-application availability. It has been around for a while and is supported on both Linux and Windows, but development seems to be stalled.
The application is affected by a remote code execution vulnerability that allows an attacker to upload a webshell tagged as a GIF image and execute malicious php code.
A typical vulnerability that has been in OSWASP top 10 A04_2021-Insecure_Design for a long time => CWE-343 Unrestricted Upload of File with Dangerous Type, but this remains a recurring implementation weakness.
All versions including v1.7.6m are vulnerable and no patch is available.
Indicators of compromise
When you want to check if your system is compromised, please look for unexpected files with extension like php, phar, php7 in the assets/data/usrimg (Linux) or assets\data\usrimg (Windows) directory. Also be conscious of the fact that the files might have been cleaned up by the attacker to cover their tracks.
Remediation
All versions of Monitorr are vulnerable, and the only mitigation is to restrict the execution of php code at the directory where the malicious file uploads are stored (Linux: <web_root>/assets/data/usrimg or Windows: <web_root\assets\data\usrimg).
I have created a Metasploit module to test this vulnerability. A local version of this module can found at the References section.
Submission to mainstream development is in progress.
References
- CVE-2020-28871
- Lyins Lab Discovery
- Public Exploit - Packetstorm
- OSWASP top 10 - A04_2021-Insecure_Design
- CWE-343 Unrestricted Upload of File with Dangerous Type
Credits
Credits goes to Lyins Lab below who discovered this vulnerability.