## Summary: There is a Remote Code Execution vulnerability at https://█████████/Kview/CustomCodeBehind/base/courseware/scorm/management/scorm2004uploadcourse.aspx which allows any user to upload a SCORM course package. Furthermore, an attacker can add an ASPX shell to the SCORM package which will then get extracted onto the server, where the attacker can then execute commands. ## Steps To Reproduce: 1. Visit `https://███████/` and log in with the credentials: `██████████` 2. Now download this "malicious" SCORM course package: █████ 3. If you `unzip scorm.zip`, you will notice this is a valid SCORM [package](https://scorm.com/scorm-explained/technical-scorm/content-packaging/), and you will also notice that I've included an ASPX file in `shared/cdlcdlcdl.aspx` which runs the `whoami` command. Notice I also included that file reference in the Scorm Manifest (`imsmanifest.xml`) 4. Visit https://████████/Kview/CustomCodeBehind/base/courseware/scorm/management/scorm2004uploadcourse.aspx, select the ██████ file. Start **intercepting** in Burp Suite Repeater. 5. Forward the POST request to `/Kview/CustomCodeBehind/base/courseware/scorm/management/scorm2004uploadcourse.aspx` 6. Now intercept the request to `/Kview/CustomCodeBehind/base/courseware/scorm/management/scorm2004editmetadata.aspx` 7. Right-Click on it, Hover down to "Do intercept" and click "response to this request" then forward it. (In your web-browser you might be able to just right-click, inspect-element, and search for strCourseId in there but my browser was being funky). 8. Once you've received the response, search for "strCourseId" and grab it. For example, you would grab `F6BAC72B45D64B34ACB662BB001D8523` out of the following response: ```html <a onclick="return ConfirmBeforeNavigateAway('Are you sure you want to navigate away from this page? \n\nYou made changes that will not be saved if you continue. \n\nClick OK to proceed or Cancel to return to the page.');" id="ML.BASE.WF.ReuploadCourse" class="WorkflowButton" NavigatingURL="Courseware/SCORM/Management/SCORM2004ReuploadCourse.aspx" ItemId="<IDTable><strCourseId>F6BAC72B45D64B34ACB662BB001D8523</strCourseId><strVersionId>F6BAC72B45D64B34ACB662BB001D8523</strVersionId></IDTable>" href="javascript:__doPostBack('ML.BASE.WF.ReuploadCourse','')"><span>Course Files</span></a> ``` 9. Now, visit `https://█████/CServer/Courseware/<YOUR_COURSE_ID>/shared/cdlcdlcdl.aspx` and you will see the shell executes: ███ ## Supporting Material/References: - https://█████/CServer/Courseware/F6BAC72B45D64B34ACB662BB001D8523/shared/cdlcdlcdl.aspx ## Proof-of-Concept Video █████████ ## Impact Critical, an attacker can execute commands on this military server, steal sensitive information, pivot to internal systems, etc. Best, @cdcl

[hta3] Remote Code Execution on https://███ via improper access control to SCORM Zip upload/import

Vulnerability Details

Actions

Report Stats

Share this report