module

OpenMRS Java Deserialization RCE

Try Surface Command
Back to search
Disclosed
2019-02-04
Created
2019-12-17

Description

OpenMRS is an open-source platform that supplies
users with a customizable medical record system.

There exists an object deserialization vulnerability
in the `webservices.rest` module used in OpenMRS Platform.
Unauthenticated remote code execution can be achieved
by sending a malicious XML payload to a Rest API endpoint
such as `/ws/rest/v1/concept`.

This module uses an XML payload generated with Marshalsec
that targets the ImageIO component of the XStream library.

Tested on OpenMRS Platform `v2.1.2` and `v2.21` with Java
8 and Java 9.

Authors

Nicolas Serra
mpgn
Shelby Pace

Platform

Linux,Unix

Architectures

x86, x64

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/multi/http/openmrs_deserialization
    msf exploit(openmrs_deserialization) > show targets
        ...targets...
    msf exploit(openmrs_deserialization) > set TARGET < target-id >
    msf exploit(openmrs_deserialization) > show options
        ...show and set options...
    msf exploit(openmrs_deserialization) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today