[0day-rubbish] Netsis NetOpenX REST 2.0.6.9 Unauthenticated SQL injection to xp_cmdshell SYSTEM command execution (9.8)

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing a vulnerability in Logo
Netsis NetOpenX REST 2.0.6.9 (also distributed as Netsis Nox REST), the REST
API gateway of the Netsis enterprise ERP suite.

Type: unauthenticated SQL injection in the OAuth 2.0 token endpoint leading to
operating-system command execution via SQL Server xp_cmdshell
(CWE-89, CWE-306, CWE-78). A single POST /api/v2/token carrying no client and
no user credentials supplies a form field named idmuserid that is concatenated
raw into a SQL statement by ServiceManager.GetIdmUserLastSessionInfo, issued
before OAuthManager.LogIn actually validates the credentials. The backend is
SQL Server, so a semicolon yields a stacked batch that enables xp_cmdshell and
then runs an OS command.

Scoring. This finding is dual-scored, with the stricter readings published
alongside the headline rather than in a footnote, each against its own vector:
- PRIMARY, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This is
  the recorded headline figure and it describes only the elevation tier, that is
  the configuration where the service's SQL login holds sysadmin, as it did in
  the verified environment. It is not a claim that command execution is available
  on every deployment.
- CONDITIONAL, 8.1 High, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The same
  impact set under a stricter attack-complexity judgement that treats the sysadmin
  property of the service login, a deployment characteristic outside the
  attacker's control, as a condition of command execution.
- CONDITIONAL lower bound, 7.5 High, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
  Where the service login is not sysadmin, the same request still yields
  unauthenticated blind SQL injection with data disclosure but no OS access.

Impact: at the elevation tier, OS command execution on the ERP database host with
the identity of the SQL Server service account (NT AUTHORITY\SYSTEM in the
verified configuration), meaning control of the ERP financial and accounting
database, exfiltration of it, and a pivot into the internal network. The
injection is blind at the HTTP layer.

Authentication: unauthenticated. The pipeline registers no global authorization
filter, the token endpoint is an OWIN middleware route on which action filters
never apply, and the shipped SQL fragment blacklist is inert.

Verification boundary, stated plainly. This was NOT verified against a stock
installed product reached across a network. A complete Netsis ERP deployment was
not achievable in the lab, so the chain was driven against a reconstruction of
the product pipeline (the real OWIN Startup, OAuthConfig, WebApiConfig and
authorization-server provider, hosted via WebApp.Start on loopback
127.0.0.1:8977, against a real SQL Server Express instance whose NETSIS login
held sysadmin), with exactly one method body, ServiceManager.GetConnectionString,
rewritten by a Mono.Cecil IL patch to clear a commercial licensing gate that is
not a security boundary. The sink, the authentication logic, the routing table,
the OAuth provider and the SQL concatenation were all left as unmodified product
code. Because the reconstruction's listener was bound to loopback, remote network
exposure is a code and deployment argument rather than an observed remote run.

Full technical analysis and a reproducible proof-of-concept:
  https://0day-rubbish.com/blog/netsis-netopenx-unauth-sqli-xp-cmdshell-rce

Project archive (ongoing disclosure series):
  https://github.com/Exploit-Garbage/0day-Rubbish

The vendor has been notified through its published security contact. No vulnerability identifier has been assigned to
this finding yet.

--
0day Rubbish Research Team
disclosure () 0day-rubbish com
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/