The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system commands by crafting malicious XML payloads, as demonstrated by a single admin/reports/reportSchemaXml.form request.
References
Link | Resource |
---|---|
https://isears.github.io/jekyll/update/2017/10/21/openmrs-rce.html | Exploit |
https://talk.openmrs.org/t/critical-security-advisory-2017-09-12/13291 | Vendor Advisory |
https://wiki.openmrs.org/display/RES/Release+Notes+2.6.1 | Release Notes Vendor Advisory |
Configurations
History
No history.
Information
Published : 2017-10-23 04:29
Updated : 2024-02-04 19:29
NVD link : CVE-2017-12796
Mitre link : CVE-2017-12796
CVE.ORG link : CVE-2017-12796
JSON object : View
Products Affected
openmrs
- openmrs
CWE
CWE-502
Deserialization of Untrusted Data