OpenSTAManager Unauthenticated Remote Code Execution via Insecure Deserialization

OpenSTAManager is vulnerable to an unauthenticated remote code execution (RCE) vulnerability due to insecure deserialization in the oauth2.php endpoint. This endpoint lacks authentication and deserializes data from the access_token field in the zz_oauth2 table without any class restrictions. An attacker who can write to the zz_oauth2 table can inject a malicious serialized PHP object, which, upon deserialization, allows arbitrary command execution on the server as the www-data user. This vulnerability can be exploited in conjunction with an arbitrary SQL injection vulnerability in the Aggiornamenti module (GHSA-2fr7-cc4f-wh98) to achieve unauthenticated RCE. The reported vulnerability affects OpenSTAManager version 2.10.1.

Attack Chain

1. SQL Injection: An authenticated attacker with administrative privileges exploits an arbitrary SQL injection vulnerability in the Aggiornamenti module (op=risolvi-conflitti-database).
2. Malicious Payload Insertion: The attacker crafts a SQL query to insert a malicious serialized PHP object into the access_token field of the zz_oauth2 table, using a known state value (e.g., poc-xxx).
3. DDL Statement for Persistence: The SQL query includes DDL statements (CREATE TABLE, DROP TABLE) to force a MySQL commit and persist the injected payload, bypassing transaction rollback.
4. Unauthenticated Request: The attacker sends an unauthenticated GET request to /oauth2.php with the state parameter set to the known value used during payload injection (e.g., oauth2.php?state=poc-xxx&code=x).
5. Data Retrieval: The oauth2.php script retrieves the record from the zz_oauth2 table based on the provided state parameter.
6. Deserialization: The script calls unserialize() on the access_token field of the retrieved record, triggering the deserialization of the injected malicious PHP object.
7. Gadget Chain Execution: The deserialization triggers a gadget chain (e.g., Laravel/RCE22) that leads to the execution of arbitrary commands. Specifically, the PendingBroadcast.__destruct() method is called, triggering the system() function with an attacker-controlled command.
8. Remote Code Execution: The attacker-specified command is executed on the server as the www-data user.

Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary commands on the affected OpenSTAManager server. The attacker gains the privileges of the www-data user, potentially leading to complete system compromise, data theft, or denial of service. Due to the combination of SQL injection and insecure deserialization, the impact is rated as critical. The number of potential victims is equal to the number of OpenSTAManager instances exposed to the internet or accessible from untrusted networks.

Recommendation

• Apply the patch or upgrade to a non-vulnerable version of OpenSTAManager as soon as it becomes available.
• Deploy the Sigma rule Detect-OpenSTAManager-OAuth2-Deserialization-Trigger to detect attempts to trigger the insecure deserialization vulnerability via crafted HTTP requests to the oauth2.php endpoint.
• Review and harden database access controls to prevent unauthorized modifications to the zz_oauth2 table, mitigating the SQL injection attack vector.
• Monitor web server logs for suspicious POST requests to actions.php with the op=risolvi-conflitti-database parameter, indicative of potential SQL injection attempts (GHSA-2fr7-cc4f-wh98).
• Implement strict input validation and sanitization to prevent SQL injection vulnerabilities in OpenSTAManager modules.