module

OpenMRS Java Deserialization RCE

Try Surface Command
Back to search
Disclosed
Feb 4, 2019
Created
Dec 17, 2019

Description

OpenMRS is an open-source platform that supplies
users with a customizable medical record system.

There exists an object deserialization vulnerability
in the `webservices.rest` module used in OpenMRS Platform.
Unauthenticated remote code execution can be achieved
by sending a malicious XML payload to a Rest API endpoint
such as `/ws/rest/v1/concept`.

This module uses an XML payload generated with Marshalsec
that targets the ImageIO component of the XStream library.

Tested on OpenMRS Platform `v2.1.2` and `v2.21` with Java
8 and Java 9.

Authors

Nicolas Serra
mpgn
Shelby Pace

Platform

Linux,Unix

Architectures

x86, x64

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/multi/http/openmrs_deserialization
    msf exploit(openmrs_deserialization) > show targets
        ...targets...
    msf exploit(openmrs_deserialization) > set TARGET < target-id >
    msf exploit(openmrs_deserialization) > show options
        ...show and set options...
    msf exploit(openmrs_deserialization) > exploit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report