NightmareFactory

NightmareFactory

Speakers: Matei "Mal" Badanoiu (Offensive Security Research Lead, Pentest-Tools.com)

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=P8eRCljizWM

Overview

In "NightmareFactory," Matei "Mal" Badanoiu, Offensive Security Research Lead at Pentest-Tools.com, unveils a series of critical vulnerabilities discovered within Dream Factory, a platform that paradoxically prides itself on "code automation for securing REST API." The presentation details 12 successfully reported vulnerabilities and one previously undisclosed zero-day, collectively demonstrating how a system designed for API security can harbor fundamental flaws leading to remote code execution (RCE), SQL injection, and other severe compromises. Badanoiu's talk is a compelling case study not only in identifying deep-seated security issues but also in navigating the often-challenging landscape of vendor disclosure.

The core of "NightmareFactory" explores the journey from initial vulnerability discovery to crafting sophisticated attack chains, culminating in a one-click RCE that, with the newly found zero-day, escalates to a zero-click RCE. This talk is crucial for developers, security professionals, and organizations that rely on API management platforms, highlighting the persistent need for rigorous security testing, even in tools marketed as security solutions. Badanoiu's engaging style, interspersed with humor and real-world anecdotes, underscores the serious implications of neglecting secure coding practices and the critical importance of responsive vulnerability management.

Background

▶ Watch: Talk introduction and speaker background (0:00)

Matei Badanoiu, known as "Mal," brings eight years of professional hacking experience to the stage, during which he has identified over 120 CVEs. As the Offensive Security Research Lead at Pentest-Tools.com, his team's mission extends beyond merely applying existing attack vectors to new software. Their long-term goals include pioneering new attack classes and contributing to the cutting edge of security research. This ethos is reflected in their internal automated exploitation tool, Sniper, which saw an exponential growth in its recognized vulnerabilities from 166 to 872 in a short period, a testament to their continuous research efforts.

The team at Pentest-Tools.com has a history of uncovering vulnerabilities in widely used software, including CPanel, Magento, Round Cube, and Odoo. Their experience with CPanel, where only one out of ten reported vulnerabilities was acknowledged, highlights the common challenges faced in vulnerability disclosure, even for issues like "self-cross-site scripting" which had previously garnered CVEs. This prior experience sets the stage for the even more complex disclosure process encountered with Dream Factory. Dream Factory itself is positioned as a critical platform for "code automation for securing REST API," boasting adoption by major entities like ExxonMobil, Google Cloud, and Toyota. The irony of its security claims is immediately apparent to Badanoiu, who points out the platform's initial demand for 16-character passwords—a high bar for users, yet one that, as the research reveals, masks deeper architectural vulnerabilities. This context underscores the talk's central theme: that even platforms marketed for security can be fraught with fundamental flaws.

Key Findings

▶ Watch: The challenging vulnerability disclosure process (8:00)

The central discovery presented in "NightmareFactory" is a comprehensive set of 12 successfully reported vulnerabilities in Dream Factory, complemented by a critical zero-day found just two weeks prior to the presentation. These vulnerabilities span a wide range of attack types, demonstrating a pervasive lack of secure coding practices within the platform. Among the reported issues were five different types of Remote Code Execution (RCE) vulnerabilities, stemming from three distinct attack classes. Beyond RCE, the team uncovered dangerous email behaviors, multiple instances of SQL Injection (SQLi), Cross-Site Scripting (XSS), and a particularly potent form of Server-Side Request Forgery (SSRF) that offered full control over methods and headers, enabling extensive internal network reconnaissance and interaction.

Further findings included weak default passwords in the Docker environment, which, if left unchanged, could grant immediate access to attackers. A seemingly low-impact, yet technically intriguing, vulnerability allowed for the arbitrary deletion of files (by replacing content with an empty string) or reading single-line files. The true power of these individual findings, however, lies in their potential for chaining. Badanoiu emphasizes that combining just two or three of these vulnerabilities could lead to a one-click RCE, requiring minimal user interaction. The newly discovered zero-day, unfortunately not detailed due to its ongoing status, elevates this to a zero-click RCE, allowing for complete compromise of any Dream Factory instance without any user interaction, given some initial reconnaissance.

The disclosure process for these vulnerabilities proved to be as challenging as their discovery. Two vulnerabilities were initially reported to the ZDI project (Zero Day Initiative), with one accepted and the other noted as having an unapplied patch. The remaining nine were reported directly to [email protected], but with no response for 15 days. Escalation attempts via the support line also failed. It was only after directly contacting the CEO on LinkedIn that a response was received, leading to the resubmission of all findings. Despite these efforts, communication ceased after August 19th, with Dream Factory failing to acknowledge new vulnerabilities or respond to inquiries. This lack of vendor responsiveness ultimately led the Pentest-Tools.com team to set a hard deadline for public disclosure, culminating in this presentation.

Technical Deep Dive

▶ Watch: RCE via PHP exec command injection (12:00)

The technical core of "NightmareFactory" is presented through "mystery findings," where Matei Badanoiu walks the audience through sanitized code snippets, encouraging them to identify the underlying vulnerabilities. This interactive approach effectively demonstrates the specific flaws and their exploitation.

One of the most critical vulnerabilities detailed was a Command Injection leading to RCE. The flaw was located within a PHP function ironically prefaced by an if ($this->isSecure) condition. Inside this block, a user-controlled password parameter, obtained via getPassword(), was directly fed into a system command executed by PHP's exec() function. Specifically, the exec() call was part of a process involving zipArchive extraction. Because the password was not sanitized, an attacker could inject arbitrary commands using a system command separator (e.g., a semicolon).

The PoC involved a POST request to the /system/package component. To trigger the vulnerable code path, the JSON request needed to set "secure": true and include a crafted password value. An example payload given was ";id > /opt/dreamfactory/public/cmd.txt". This would execute the id command and redirect its output to a file (cmd.txt) within the web-accessible root directory (/opt/dreamfactory/public), allowing the attacker to retrieve the command's output directly via a web browser. The fix, implemented by Kevin for ZDI-CAN-26589, involved using escape shell args, a crucial PHP function for sanitizing command-line arguments.

Another significant finding was a SQL Injection vulnerability, located within a function named selectByRequest. The core issue resided in the use of a $builder->whereRaw() function, which, as its name suggests, allows for the insertion of raw SQL statements into the WHERE clause. While builders are generally considered safe, the whereRaw function bypasses the usual sanitization mechanisms, making it dangerous when user-controlled input is passed directly. The vulnerable code took a condition parameter, which was user-controlled and directly incorporated into the whereRaw clause.

Initial exploitation involved a boolean-based SQL injection through the filter parameter. However, further investigation yielded a more impactful UNION SELECT injection, allowing direct exfiltration of database content into the application's response. An example demonstrated exfiltrating the database user, revealing df_admin@an_IP_from_Docker. Badanoiu stressed the importance of optimizing SQLi exploitation beyond time-based techniques, advocating for boolean-based or error-based methods when possible, to improve efficiency and reduce detection chances.

Finally, the talk covered a Path Traversal vulnerability, which, when chained with other issues, could lead to RCE. The vulnerability was patched by a line in the code: resource = string_replace("..", "", resource), indicating that unsanitized .. sequences in paths were being processed. This flaw affected the /api/v2/files endpoint, where the resource parameter in the URI was susceptible to path traversal. An attacker could specify a path like ../../public/ to write files outside the intended directory, specifically into the web root.

The challenge then became uploading executable PHP content while bypassing Dream Factory's file type whitelisting, which attempted to determine the file's signature from its content. The ingenious bypass involved prepending the PHP payload with an SVG tag: <svg><?php echo \$_GET[0]\; ?></svg>. This made the file appear as a "safe" SVG image to the content-type detection mechanism, while still containing executable PHP code that could be triggered by accessing the uploaded file with a GET parameter (e.g., ?0=id). This allowed for arbitrary command execution via the uploaded file, completing the RCE chain.

Demo / Proof of Concept

▶ Watch: SQL Injection using wear raw builder (15:00)

The "NightmareFactory" presentation itself served as an interactive demonstration of the discovered vulnerabilities. Rather than a live hack, Matei Badanoiu adopted a "mystery findings" format, presenting simplified, yet accurate, code snippets to the audience and challenging them to identify the flaws. This pedagogical approach effectively showcased the Proof of Concepts (PoCs) for each class of vulnerability.

For the Command Injection RCE, the PoC was detailed by showing a POST request to /system/package. The critical elements were the secure: true flag and the password parameter containing the command injection payload, such as ";id > /opt/dreamfactory/public/cmd.txt". This demonstrated how an attacker could inject arbitrary commands and retrieve their output by writing to a web-accessible file, illustrating the direct path to remote code execution.

The SQL Injection PoC was explained by highlighting the selectByRequest function and the misuse of $builder->whereRaw(). The demonstration moved from a conceptual boolean-based injection using the filter parameter to a more impactful UNION SELECT query that directly extracted sensitive information, such as the df_admin database user and its associated IP address from Docker. This showed the progression of an attacker's capabilities from mere truth discovery to direct data exfiltration.

The Path Traversal PoC, leading to RCE, involved demonstrating how the /api/v2/files endpoint could be manipulated. The core of this PoC was the crafted URI with ../../public/ in the resource parameter, allowing file writes to the web root. The innovative aspect was the content of the uploaded file: an SVG tag (<svg>) followed by PHP code (<?php echo \$_GET[0]\; ?>). This bypassed Dream Factory's content-based file type whitelist, allowing a malicious PHP file to be stored and then executed by simply navigating to its URL and providing a command via a GET parameter (e.g., cmd.php?0=ls). Each "mystery finding" served as a clear, step-by-step PoC, demonstrating the attack vector and its outcome, cementing the technical findings in an engaging manner.

Defensive Implications

▶ Watch: Directory traversal and SVG file type bypass (17:00)

The findings presented in "NightmareFactory" offer critical insights for defenders, particularly those managing API platforms or any web application. The prevalence of fundamental vulnerabilities like command injection, SQL injection, and path traversal, even in a system designed for API security, underscores the need for a multi-layered defensive strategy.

First and foremost, rigorous input validation and sanitization are paramount. Developers must move beyond basic filtering and employ context-aware sanitization for all user-supplied data. For command execution, functions like PHP's escape shell args are essential to prevent command injection, as demonstrated by Dream Factory's patch. For SQL queries, parameterized queries or Prepared Statements should be universally adopted to eliminate SQL injection vulnerabilities, rather than relying on raw SQL clauses like whereRaw(). Path traversal can be mitigated by strictly validating and normalizing file paths, disallowing .. sequences, and restricting file operations to designated, non-web-accessible directories.

Secondly, the talk highlights the importance of secure coding practices and avoiding dangerous functions. Direct use of exec() or similar system command execution functions with untrusted input is a recipe for RCE. Similarly, any function that allows "raw" input into security-sensitive contexts (like whereRaw() for SQL) should be treated with extreme caution and ideally avoided, or at least wrapped in custom sanitization layers.

Third, robust file upload validation is crucial. Merely checking file extensions or MIME types is insufficient. As demonstrated by the SVG bypass, content-based analysis can also be tricked. Comprehensive validation should involve multiple checks: whitelisting allowed extensions, performing deep content inspection (e.g., using libraries that truly parse file formats), and storing uploaded files in isolated, non-executable directories, serving them only after strict validation.

Fourth, default security configurations must be hardened. Weak default passwords, especially in environments like Docker, create immediate attack surfaces. All default credentials should be changed upon deployment.

Finally, the challenging vendor disclosure process with Dream Factory serves as a stark warning. Organizations must establish clear, accessible, and responsive channels for vulnerability reporting. Ignoring security researchers not only harms the company's reputation but also delays critical patches, leaving users exposed. Defenders should prioritize applying patches promptly and actively monitor for new disclosures affecting their deployed software. The chaining of vulnerabilities also emphasizes the need for a holistic security view; even seemingly low-impact flaws can become critical when combined.

Key Takeaways

• API Security Requires Deeper Scrutiny: Despite being marketed for "securing REST API," Dream Factory harbored fundamental vulnerabilities, emphasizing that security claims must be validated through rigorous testing.
• Common Vulnerabilities Persist: Basic flaws like command injection, SQL injection, and path traversal remain prevalent, even in modern applications, highlighting the continuous need for foundational secure coding practices.
• Input Validation is Non-Negotiable: All user input must be meticulously validated and sanitized in a context-aware manner to prevent injection attacks. This includes using functions like escape shell args and parameterized queries.
• Creative Bypass Techniques are Real: Attackers will find ingenious ways to bypass security controls, such as the SVG file upload trick, necessitating defense-in-depth and comprehensive validation strategies beyond simple checks.
• Vendor Responsiveness is Critical: The difficult disclosure process with Dream Factory underscores the importance of vendors having clear, responsive, and respectful channels for security researchers.
• Vulnerability Chaining Amplifies Impact: Seemingly minor vulnerabilities can be chained together to achieve high-impact attacks like one-click or zero-click RCE, stressing the need to address all identified flaws.

About the Speaker(s)

Matei "Mal" Badanoiu is an accomplished Offensive Security Research Lead at Pentest-Tools.com, bringing eight years of professional experience in identifying and exploiting security vulnerabilities. During his career, he has discovered over 120 CVEs, showcasing his deep technical expertise and dedication to the field. Matei is a recognized speaker at prominent security conferences, including DefCamp (where he has spoken multiple times, including 2023 and 2024) and Inclusion Apoca. Beyond his research and speaking engagements, he is passionate about mentoring the next generation of hackers, guiding aspiring security professionals. Matei also acknowledges the crucial contributions of his team members—Mate Buzza, Catalinho Vitza, David Bosch, and Alexander Postoake—whose collaborative efforts were instrumental in the research presented.