[FD] Security advisory: Pre-authentication SYSTEM RCE in iMonnit Express 4.0.5.5 (Monnit / iMonnit)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in iMonnit 
Express 4.0.5.5 (Monnit / iMonnit). The research is published and a 
proof-of-concept is available.

Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)

iMonnit Express 4.0.5.5 is an ASP.NET Core application running as a Windows 
service with LocalSystem privileges, with no global [Authorize] filter. Three 
flaws combine into a fully unauthenticated root RCE chain: an auth bypass (an 
empty security answer list issues a valid admin cookie), a path-traversal file 
write in the certificate upload endpoint (reachable with the forged cookie), 
and a plugin loader that calls Assembly.Load + Activator.CreateInstance on the 
plugin's parameterless constructor BEFORE the IExpressPlugin check - the 
constructor runs as LocalSystem. Dynamically verified: whoami = nt 
authority\system.

Impact: Full read of the host filesystem and configuration as NT 
AUTHORITY\SYSTEM, arbitrary OS command execution, and full control of the 
iMonnit Express host.

Advisory: https://0day-rubbish.com/blog/imonnit-express-unauth-plugin-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/