Security advisory: Pre-authentication SYSTEM RCE (Zip-Slip plugin planting) in Output Messenger Server 2.0.x (>= 2.0.63) (Srimax Software (Output Technology))

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing a vulnerability in Output Messenger Server 2.0.x (>= 2.0.63) (Srimax 
Software (Output Technology)). The research is published and a proof-of-concept is available.

Pre-authentication SYSTEM RCE (Zip-Slip plugin planting) (CVSS 9.8, pre-authentication)

Output Messenger Server 2.0.x accepts XMPP connections on TCP 14121 with no SASL and no credentials; every connection 
is treated as authenticated. Through linkserver registration and the file-transfer listener, an unauthenticated 
attacker uploads a crafted ZIP whose entries escape the plugin directory (Zip-Slip in SharpZipLib 0.85.4). On service 
restart, the planted plugin constructor executes as LocalSystem. Dynamically verified.

Impact: Full compromise of the on-premise enterprise instant-messaging server as LocalSystem. The attacker can read 
corporate communications, execute arbitrary commands, and move laterally inside the office network.

Advisory: https://0day-rubbish.com/blog/output-messenger-unauth-zipslip-plugin-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

Vendor has been notified. CVE ID is pending.

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/