If you are passionate about music and especially historical rock bands, the post’s title could have rung a bell on you. It is indeed the parody of the famous song “Another Girl, Another Planet“. It may be that you know it because of the Blink 182 cover song more than for the original piece sung by “The Only Ones” band. Anyway, the focal point of the title is that, regardless the pun, there are so many documented cases out there where a SSRF bug has led straight to execution of remote code that should not come as a surprise if today we are going to add another one over the table.
What reported here is the output of a web application penetration test we quickly conducted early last autumn on Microstrategy Intelligence Server & Web, that brought us to discover six different vulnerabilities and recently to register a total of five CVE(s). Until now these vulnerabilities have been unknown to the public.
Microstrategy Intelligence Server & Web
MicroStrategy Intelligence Server (also dubbed iserver) is an analytical server optimized for enterprise querying, reporting, and OLAP analysis. A front-end component, called MicroStrategy Web, connects to iserver and provides users with an interface for reporting and analysis.
The application includes a functionality allowing users to import files or data from external resources such as URLs or databases. Of particular interest is the “File From URL” option. This sounds like a feature that would be typically vulnerable to SSRF (Server Side Request Forgery). Let’s check it.
We first create the file “
pwned.txt” with random content and host it somewhere over the internet:
$ cat pwned.txt
You are Pwn3d!
Now, what if an external URL under the attacker’s control referencing that file (for example “http://attacker_ip:8080/pwned.txt”) is typed into the “Upload your files” textbox as shown below?
What happens with Microstrategy 10.4 (and potentially above) is that the application downloads the file’s content from the attacker-controlled machine…
…then parses and prints it into the dashboard area.
Ehi, but wait! If we carefully take a look at the first screenshot coming with this blog post, a label over the “File From URL” option is explicitly stating that the usage of “
file://” scheme is allowed too. How would the application react if we provided the string “
file:///etc/passwd” instead of a URL? The picture below clearly answers this question.
Well we have officially a SSRF (registered as CVE-2020-11452) that an attacker can take profit of to retrieve arbitrary files from the local system where the Microstrategy solution is installed. This is great: we can get the content of files whose path is well-known (for example OS configuration files) or proceeding by trial and error approach if unknown. However, it would be even better if we could at least identity the full path of the application server (or servlet container) where the application is hosted and continue the analysis from that angle.
Here is where a second vulnerability comes in. Browsing to the URL “
/MicroStrategyWS/happyaxis.jsp”, as an unauthenticated user, we can obtain some basic information such as the JVM version in use, the CPU architecture and the installation folder of the application server or servlet container (tomcat in our case).
With RedTimmy Security we have registered this information disclosure bug as well and MITRE assigned to it the CVE-2020-11450.
Needless to say, once the base configuration folder of Tomcat is known, more paths and information about the deployed applications can be obtained from “
web.xml”, tomcat log files, etc… So it should not come as a surprise if after obtaining these resources through the SSRF and carefully analyzed them, we ended up to exfiltrate private keys and passwords, sometimes obfuscated, sometimes in clear-text (by the way, how to de-obfuscate passwords in Tomcat is a good story for another blog post).
By analyzing the tomcat configuration files, we also learnt that Microstrategy comes with an administration console reachable from “https://hostname/MicroStrategy/servlet/admin”. Eventually one of the passwords previously retrieved has worked against the admin panel, which has open us the door to the exploitation of the most boring RCE vulnerability ever.
Once logged into the Microstrategy admin panel, the “Upload Visualization”plugin accessible from the “Custom Visualizations” link (see image above), allows a global administrator to upload a zip archive containing files with arbitrary extensions and data.
Why don’t we upload a zip archive containing a malicious JSP web shell? We have used for the purpose something similar to this and renamed it as “
admin.jsp”. The bottom line is that regardless what is put inside the zip archive, these file(s) are then extracted to the publicly accessible URL “
All we need to do now is just pointing the browser to the resource “https://hostname/MicroStrategy/plugins/admin.jsp” to invoke the web shell and execute arbitrary OS commands with the privileges of the Tomcat user.
During our assessment we have discovered more bugs.
CVE-2020-11453 is another Server-Side Request Forgery in the “Test Web Service” functionality exposed through the path “
/MicroStrategyWS/”. The functionality requires no authentication and, while it is not possible to pass arbitrary schemes in the SSRF request, it could still be possible to exploit it in order to conduct port scanning.
Specifically the attacker browses the URL “https://hostname/MicroStrategyWS/” and passes an arbitrary IP address/hostname and port number into the “Intelligence Server” and “Port Number” textboxes.
CVE-2020-11454 is instead a Stored Cross-Site Scripting vulnerability affecting the “HTML Container” and “Insert Text” functionalities in the window allowing for the creation of a new dashboard. The application allows to insert new text lines inside a created dashboard or opening a ready one. Basically it is possible to change its type from “iframe” to “HTML Text” right-clicking on it and selecting “Properties and Formatting”.
The HTML code injected will be evaluated every time the dashboard is loaded.
That’s all for today. If you want to learn more in-depth webapp hacking techniques, remember to join us at Blackhat Las Vegas this year with our Practical Web Application Hacking Advanced Course on 1-2 August and 3-4 August! We look forward to see you there!
Also, why don’t you follow us on twitter? https://twitter.com/redtimmysec