Security advisory: Pre-authentication SYSTEM RCE in iMonnit Express 4.0.5.5 (Monnit / iMonnit)

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing a vulnerability in iMonnit Express 4.0.5.5 (Monnit / iMonnit). The 
research is published and a proof-of-concept is available.

Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)

iMonnit Express 4.0.5.5 is an ASP.NET Core application running as a Windows service with LocalSystem privileges, with 
no global [Authorize] filter. Three flaws combine into a fully unauthenticated root RCE chain: an auth bypass (an empty 
security answer list issues a valid admin cookie), a path-traversal file write in the certificate upload endpoint 
(reachable with the forged cookie), and a plugin loader that calls Assembly.Load + Activator.CreateInstance on the 
plugin's parameterless constructor BEFORE the IExpressPlugin check - the constructor runs as LocalSystem. Dynamically 
verified: whoami = nt authority\system.

Impact: Full read of the host filesystem and configuration as NT AUTHORITY\SYSTEM, arbitrary OS command execution, and 
full control of the iMonnit Express host.

Advisory: https://0day-rubbish.com/blog/imonnit-express-unauth-plugin-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/