| Overview : | ||
|
||
| CVE ID :CVE-2020-10365 |
LogicalDoc Virtual Appliance Multiple Vulnerabilities1. Advisory InformationTitle: LogicalDoc Virtual Appliance Multiple Vulnerabilities 2. Vulnerability InformationClass: Unrestricted Upload of File with Dangerous Type [CWE-434], Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) [CWE-22], SQL Injection [CWE-89] Impact: Code execution allows privilege escalation 3. Vulnerability DescriptionLogicalDoc [1] is a global software company that sells an enterprise document management system (DMS) designed to provide administration and serve as a repository for an organization’s content. Multiple vulnerabilities were found in the Virtual Appliance version, which would allow a remote unauthenticated attacker to upload arbitrary files that could lead to the execution of arbitrary commands with root privileges. 4. Vulnerable Packages
Other products and versions might be affected, but they were not tested. 5. Vendor Information, Solutions, and WorkaroundsLogicalDoc published a patched version of the product on 2019-08-30 with the 8.3.3 release which fixes these issues. 6. CreditsThese vulnerabilities were discovered and researched by Ivan Huertas from Core Security Consulting Services. The publication of this advisory was coordinated by Pablo A. Zurro from Core Advisories Team. 7. Technical Description / Proof of Concept CodeLogicalDoc Virtual Appliance is a free virtual appliance version of the LogicalDoc Document Management tool. It is designed to be deployed inside an organization’s network infrastructure. It comes bundled with a Web Management Console for documents, messaging systems, user management, and other services. Multiple vulnerabilities were found in the context of this appliance, which could allow a remote attacker to compromise the whole system. Vulnerabilities described in 7.1 and 7.2 could allow an attacker to upload arbitrary files which lead to command execution and dump data from the database. 7.1 Arbitrary file upload leading to remote command execution[ CVE-2020-9423] LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users, applying tags, etc. This functionality could be abused by an unauthenticated attacker to upload an arbitrary file in a restricted folder. This would lead to the executions of malicous commands with root privileges.The following proof of concept demonstrates the vulnerability: Firstly, we used the mechanism called “Add Documents” to add a new document in the following path: /frontend/document. A pop-up appears where multiple files could be dragged and dropped. In the background a request to /servlet.gupld is performed. This last servlet is vulnerable to an arbitrary file upload and a path traversal, as we are able to change the path by inserting ../ characters in the name parameter of the request. As an extra verification, we performed this exact request without providing a session cookie and trying to store the file in the /etc/cron.d/ directory. This file contained commands to execute a reverse shell to our attack server. This was confirmed so an unauthenticated attack could exploit this issue.
One minute after sending the request, we received the reverse connection on our server. Since the web server is running with root privileges, our reverse shell had the maximum privileges on the system.
7.2 SQL injection[ CVE-2020-10365] LogicalDoc populates the list of available documents by querying the database. This list could be filtered by modifying some of the parameters. We confirmed that some of them are not properly sanitized, which could allow an authenticated attacker to perform arbitrary queries to the database. Below is a common request to retrieve the list of documents:
Boolean-based SQL Injection is a SQL Injection technique that relies on sending an SQL query to the database which forces the application to return a different result depending on whether the query returns a TRUE or FALSE result. We tampered with the filename parameter to create a valid SQL query. Below is an example of a TRUE statement:
Below is an extract of information retrieved by sending multiple SQL queries:
8. Report Timeline2019-07-18 – Core Security made initial contact with LogicalDoc, including a draft advisory with two vulnerabilities. 2019-08-30 – Vulnerabilities solved by LogicalDoc in version 8.3.3. 2020-02-26 – Applied for first CVE via MITRE website, received confirmation of application. 2020-02-28 – MITRE assigns CVE-2020-9423 to first vulnerability. 2020-03-10 – Applied for CVEs via MITRE for second vulnerability. MITRE assigns CVE-2020-10365. 2020-03-18 – Advisory published. 9. References[1] https://www.logicaldoc.com/10. About CoreLabsCoreLabs, the research center of Core Security, A HelpSystems Company is charged with researching and understanding security trends as well as anticipating the future requirements of information security technologies. CoreLabs studies cybersecurity trends, focusing on problem formalization, identification of vulnerabilities, novel solutions, and prototypes for new technologies. The team is comprised of seasoned researchers who regularly discover and discloses vulnerabilities, informing product owners in order to ensure a fix can be released efficiently, and that customers are informed as soon as possible. CoreLabs regularly publishes security advisories, technical papers, project information, and shared software tools for public use at https://www.coresecurity.com/core-labs. 11. About Core Security, A HelpSystems CompanyCore Security, a HelpSystems Company, provides organizations with critical, actionable insight about who, how, and what is vulnerable in their IT environment. With our layered security approach and robust threat-aware, identity & access, network security, and vulnerability management solutions, security teams can efficiently manage security risks across the enterprise. Learn more at www.coresecurity.com. Core Security is headquartered in the USA with offices and operations in South America, Europe, Middle East and Asia. To learn more, contact Core Security at (678) 304-4500 or info@helpsystems.com. 12. DisclaimerThe contents of this advisory are copyright (c) 2020 Core Security and (c) 2020 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/ 13. PGP/GPG KeysThis advisory has been signed with the GPG key of Core Security advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc.
|