Common Program Exploits

What Do Web. Logic, Web. Sphere, JBoss, Jenkins, Open. NMS, and Your Application Have in Common? This Vulnerability. By @breenmachine. What? The most underrated, underhyped vulnerability of 2. I’m about to bring it to yours.

The ME3 Coalesced Utility allows you to open the Coalesced.bin file that comes with Mass Effect 3. The latest version now supports editing and saving the file. In computer security terms, an exploit is an object - a program, a section of code, even a string of. This page lists exploits in Fallout 3. Exploits should be written with brevity and clarity in mind. Please observe the editing guideline. In particular, do not use. Symantec blended attacks exploits, vulnerabilities and buffer-overflow techniques in computer viruses

No one gave it a fancy name, there were no press releases, nobody called Mandiant to come put out the fires. In fact, even though proof of concept code was released OVER 9 MONTHS AGO, none of the products mentioned in the title of this post have been patched, along with many more. In fact no patch is available for the Java library containing the vulnerability. In addition to any commercial products that are vulnerable, this also affects many custom applications.

In this post I’ll be dropping pre- authentication, remote code execution exploits that leverage this vulnerability for Web. Logic, Web. Sphere, JBoss, Jenkins, and Open. NMS. All on the newest versions. Even more interesting, I’ll detail the process we went through to discover that these products were vulnerable, and how I developed the exploits. This should empower you to go out and find this same bug in your own software or commercial products that you or your clients use. All code can be found on the Fox.

Glove Security Github. I’ll also be touching on why this bug is unlikely to go away soon.

IBM DB2 Connect 10.1 for Linux, UNIX, and Windows exploits latest features in IBM DB2 10 for z/OS and IBM DB2 for i 7.1, adds deployment flexibility. The `men of my class', were heroes in the eyes of the girls, who never wearied of the exploits of `our fellows', and were frequently allowed to bask in the smiles of.

There are several methods of classifying exploits. The most common is by how the exploit contacts the vulnerable software. A remote exploit works over. Common Weakness Enumeration (CWE) is a list of software weaknesses.

You can infuriate your developers and ops people by telling them to follow the instructions in “The Fix” section to remediate this in your environment. It will fix it, but it’s an admittedly ugly solution. This post is going to be long. Because I’m a nice person, I made you an index. Feel free to skip straight to the exploits if you’ve got better things to do than read my rambling: Background – Unserialize vulnerabilities and why didn’t I hear about this sooner? The Vulnerability – Light details on the work of @frohoff and @gebl.

How Common is Commons? Most programming languages provide built- in ways for users to output application data to disk or stream it over the network.

The process of converting application data to another format (usually binary) suitable for transportation is called serialization. The process of reading data back in after it has been serialized is called unserialization. Vulnerabilities arise when developers write code that accepts serialized data from users and attempt to unserialize it for use in the program. Depending on the language, this can lead to all sorts of consequences, but most interesting, and the one we will talk about here is remote code execution. Previous Work. There have been a few Java unserialize vulnerabilities published in the past few years. One was discovered in the Spring framework, another in Groovy, and yet another in one of the other commons library, commons fileupload. All of these vulnerabilities were eventually fixed.

Unfortunately I can’t take credit for. Myself and a fellow researcher. Nearly two years ago, we decided we wanted 0- day in Web. Sphere application server. The project started off promising, with such a large code base and so much exposed, there had to be something vulnerable.

After some time searching we eventually got it into our heads that it would be amazing if we could find an unserialize vulnerability in Java or a common library. Because EVERYTHING in the Java world uses object serialization, and almost everything can be coerced into accepting unsafe, user provided serialized data (see the exploits section of this post for proof). We started down this path and found some cool leads in the world of Java unserialize vulnerabilities, some of which we’ll probably continue to look into. Unfortunately, we didn’t find anything leading to remote code execution. Java Serialization –.

Here I’ll describe the basics of how it works in Java, and why an unserialize vulnerability in any of the hundreds of libraries your application loads, even libraries you don’t use, can ruin your day. As described earlier, serialization is the process by which your programming language lets you convert data to a static, binary format, suitable for saving to disk or sending over the network. Unserialization, or deserialization, is exactly the opposite. It takes binary data and converts it back to something that you can use. Since this is all a bit hand- wavy and high level, let’s take a look at some basic. The following shows the output from running this code.

Desktop/Serial. Test$ java Serialize. Test. breens@us- l- breens: ~/Desktop/Serial. Test$ xxd name. ser.

Notice the file on disk “name. In particular the bytes “aced 0.

Java serialized object. Not particularly exciting, but a good demonstration of the basics of Java object serialization. Java Objects and More Complex Serialization.

As an object oriented language, Java has a concept of Objects. Those unfamiliar with the concept can think of these like user defined data types. For example, in Java, a String is a type, and you can do things like this. String name = . They’re part of the definition of the “String” object. As a programmer, you can define your own objects and methods. Now that we’ve skipped about 6 months of “Intro to Java”, let’s skip a few more and go straight to custom object serialization.

Consider the following code. Object. Input. Stream. File. Input. Stream. Object. Output. Stream. File. Output. Stream.

Serializable. import java. IOException. public class Serialize. Test. The code here is very similar to the basic one we first showed, except here the object being serialized is user- defined and called “My. Object”. The “My. Object” class implements the java “Serializable” interface, and defines a method called “read. Object”. Now looking at the output, we see something a little strange. Instead of the name we defined in the string, “bob”, getting printed to the console, we see that “bob!” got printed.

Further, if we read the output from “xxd” to see what was written to disk, we don’t see any trace of the rogue exclamation point! Where did this come from?

The key here is the read. Object method of course. When Java reads in a serialized object, the first thing it does after reading in the raw bytes is call the user- defined “read. Object” method if it exists. In this case, the “read. Object” method appended an exclamation point to the name.

What Could Possibly Go Wrong? Now let’s consider what we’ve learned so far in the context of Java web applications and application servers. Java LOVES sending serialized objects all over the place. For example: In HTTP requests – Parameters, View. State, Cookies, you name it.

RMI – The extensively used Java RMI protocol is 1. RMI over HTTP – Many Java thick client web apps use this – again 1.

JMX – Again, relies on serialized objects being shot over the wire. Custom Protocols – Sending an receiving raw Java objects is the norm – which we’ll see in some of the exploits to come. Okay, so what you ask? Well what if we knew of an object that implemented a “read. Object” method that did something dangerous? What if instead of appending an exclamation point to a user defined string, it could be massaged into running a user defined command on the operating system?

That would be pretty bad. Suppose such a vulnerable object existed, but wasn’t part of “core” Java, but instead just part of a library. Think about the requirements for exploitation: That library would need to be on the Java “classpath”The application would need to deserialize untrusted user input. We’ve already determined that requirement 2 is very often satisfied.

Requirement 1 could be satisfied if we could find such a vulnerability in a commonly used library. The world didn’t seem to care. During their talk, Gabriel and Chris released an unserialize vulnerability in the “commons collections” library that results in remote code execution.

This library is EXTREMELY popular in the Java world. What this means is that any application or application framework that uses it (there are many), and unserializes untrusted data (again many) now has an open CVSS 1. This means: Defenders – Anyone on your network and potentially the Internet can compromise many of your application servers, including some appliances. Pentesters – This vulnerability is amazing. Runs in memory and isn’t going away anytime soon. Remote code execution in many many things including custom applications. Checkbox Checkers – Uncheck the boxes, you’re probably not compliant anymore (and let’s be honest, you probably never were)How do you fix it?

After nearly a year, the commons- collections framework still has this bug outstanding. You need to manually fix the library by hand by removing class files that are leveraged by the exploit from the Jar file.

See “The Fix” section of this post for more detailed information. Further, Java libraries aren’t like other libraries we’ve seen these types of vulnerability in. For example Open.

SSL is usually run as a shared library, so you can update all your Red. Hat boxes and magically you’re not vulnerable to Heart. Bleed anymore. Java libraries are a mess in comparison. Every application server comes with its own bundle of libraries, even worse, every application you deploy on the server often comes with its own set as well. To fix this completely, you need to find and update every single library individually.

The Vulnerability. The unserialize vulnerability is in the commons- collections Java library. If you recall from the Background section, we were looking for a Java object that does something “dangerous” inside of its “read. Object” method. This exploit follows a maze of objects, all nested inside each other with the end result being that unserializing the parent causes a command to be run on the system. The following is taken directly from the payload generating code released on github. Invocation. Handler get. Object(final String command) throws Exception .

Matthias Kaiser recently gave a talk and walked through it in a little more detail. I’ll avoid explaining it entirely as we’ll focus more on the applicability of unserialize exploits. The take- away from this is that the “Objects” you see in the code above are the ones required for exploitation.