CVE-2018-19276

Related Files

OpenMRS Java Deserialization Remote Code Execution

Posted Dec 17, 2019

Authored by Nicolas Serra, Shelby Pace, mpgn | Site metasploit.com

OpenMRS is an open-source platform that supplies users with a customizable medical record system. There exists an object deserialization vulnerability in the webservices.rest module used in OpenMRS Platform. Unauthenticated remote code execution can be achieved by sending a malicious XML payload to a Rest API endpoint such as /ws/rest/v1/concept. This Metasploit module uses an XML payload generated with Marshalsec that targets the ImageIO component of the XStream library. Tested on OpenMRS Platform v2.1.2 and v2.21 with Java 8 and Java 9.

tags | exploit, java, remote, code execution

advisories | CVE-2018-19276

SHA-256 | 6f1e855ade450fdc21c2afb884ec83e11fd67f1b304b45c6db40c7d5cf974dc7

Download | Favorite | View

OpenMRS Platform Insecure Object Deserialization

Posted Feb 6, 2019

Authored by Bishop Fox

OpenMRS Platform versions prior to 2.24.0 suffers from an insecure object deserialization vulnerability.

tags | exploit

advisories | CVE-2018-19276

SHA-256 | 9bf1c1fe0961989653634a152fe1a2263d4a1488abc16bf63c5f68b95b248603

Download | Favorite | View