Ysoserial and Jenkins commons collection exploit - what can you do?

Question

I have read about the Jenkins exploit of the Commons Collections vulnerability. I've tested this (legitimately) on a system, but I'm not very good at this, so I can't seem to achieve much. What is the worst case scenario if someone takes advantage of this vulnerability? What is possible to do?

Answer 1

This vulnerability is actually very widespread especially inside Enterprises that use Java heavily. There is an excellent article written by Sijmen Ruwhof that covers this topic and how it effects a lot of leading Java application servers and tools like Jenkins.

There is also a great article written by Will Sargent which goes into the problems with Java serialization, the various ways it can be exploited and suggests some mitigations. One of the mitigations is installing the NotSoSerial Java agent on all JVMs in your network. This would be an easier fix in the short term while waiting for all the applications to be patched and rebuilt. It involves just modifying the JVM startup arguments.

Answer 2

Just read on in the same article and you will find:

This vulnerability is amazing. Runs in memory and isn’t going away anytime soon. Remote code execution in many many things including custom applications

So this vulnerability will allow remote execution as a non-privileged user in many cases. From there is is often possible to elevate the privileges, i.e. to super user and maybe to attack other machines in the internal network.

Of course this needs malicious user input. If you can guarantee that no such input is ever sent to the application then you are probably safe. You probably cannot guarantee it for public installations. You might think you can control it for internal installations but I would not count on it, because internal and external applications are usually both accessed by the same browser. And using CSRF , XSS or similar attacks an external site can harm an internal site by using the browser as a trampoline.

What is possible to do?

This is also explained in the The Fix - Kind of... part of the post. In effect, you need to fix the relevant library, replace the library with a fixed on inside your application and roll out the application everywhere.

Answer 3

In addition to what others have said (the posts by blownie55 and Steffen Ullrich are excellent), I'd like to add a bit of extra information here.

---

Worst Case Scenario

What is the worst case scenario if someone takes advantage of this vulnerability? What is possible to do?

If your application has been targeted successfully, then this attack allows remote code execution, meaning an attacker can likely do anything they want to your system. This allows them to run their own applications, alter your unsigned code, alter your signed code if they're able to compromise your source repository, and worst of all, access your customer's data.

Any machines accessible to the compromised machine should also be considered vulnerable.

In a worst case scenario, it's essentially a breach of customer and/or user data, or even your trade secrets - something no legitimate company ever wants to happen.

If you're using WebSphere, then IBM has released a patch for this.

---

Determining Vulnerability

Taken from IBM's website: The IBM WebSphere Application Server Liberty profile only enables the Apache Commons Collections if you are using ONE of the following three features:

• jsf-2.0
• jsf-2.2
• jpa-2.0

You may be vulnerable if you are using any one of these features. To determine if you are vulnerable you can look in the console.log for this message:

[AUDIT ] CWWKF0012I: The server installed the following features: [xxxxx]

If in place of the xxxxx, it does not contain any one of those three features listed, then you are not vulnerable.

---

Snort IDS Rules

You'll need to protect your server from incoming exploits over the network. Snort is an intrusion detection system that helps prevent unauthorized access. If you're using Snort, here are the rules you'll need:

alert tcp any any -> $HOME_NET any (msg:" ETPRO EXPLOIT Serialized Java Object Calling Common Collection Function"; flow:to_server,established; content:"rO0ABXNyA"; content:"jb21tb25zLmNvbGxlY3Rpb25z"; fast_pattern; distance:0; reference:url,github.com/foxglovesec/JavaUnserializeExploits; classtype:misc-activity; sid:2814811; rev:1;)

alert tcp any any -> $HOME_NET any (msg:" ETPRO EXPLOIT Serialized Java Object Calling Common Collection Function"; flow:to_server,established; content:"|ac ed 00 05 73 72 00|"; fast_pattern; content:"commons.collections"; nocase; distance:0; reference:url,github.com/foxglovesec/JavaUnserializeExploits; classtype:misc-activity; sid:2814812; rev:1;)

alert tcp any any -> $HOME_NET any (msg:" ETPRO EXPLOIT Serialized Java Object Generated by ysoserial"; flow:to_server,established; content:"|ac ed 00 05 73 72 00|"; fast_pattern; content:"java/io/Serializable"; nocase; distance:0; content:"ysoserial/payloads/util/Gadgets"; reference:url,github.com/foxglovesec/JavaUnserializeExploits; classtype:misc-activity; sid:2814813; rev:1;)

alert tcp any any -> $HOME_NET any (msg:" ETPRO EXPLOIT Serialized Groovy Java Object Generated by ysoserial"; flow:to_server,established; content:"|ac ed 00 05 73 72 00|"; fast_pattern; content:"org.codehaus.groovy.runtime.ConversionHandler"; nocase; distance:0; content:"ysoserial/payloads/util/Gadgets"; reference:url,github.com/foxglovesec/JavaUnserializeExploits; classtype:misc-activity; sid:2814814; rev:1;)

alert tcp any any -> $HOME_NET any (msg:" ETPRO EXPLOIT Serialized Spring Java Object Generated by ysoserial"; flow:to_server,established; content:"|ac ed 00 05 73 72 00|"; fast_pattern; content:"org.springframework.core.SerializableTypeWrapper"; nocase; distance:0; content:"ysoserial/payloads/util/Gadgets"; reference:url,github.com/foxglovesec/JavaUnserializeExploits; classtype:misc-activity; sid:2814815; rev:1;)

 

---

Aftermath

Because this exploit allowed remote code execution, you'll have to do a forensic sweep of the affected system, and any machines which it had access to. There's a possibility that the rabbit hole goes much deeper. This kind of sweep is a bit too broad for this answer, though.