Attack Chain

1. An attacker crafts a malicious JavaScript payload designed to execute arbitrary code on the server, leveraging the java.lang.Runtime class.
2. The attacker authenticates to the OpenRemote platform with a user account that has the write:rules role.
3. The attacker sends an HTTP POST request to /api/{realm}/rules/realm with a JSON payload containing the malicious JavaScript code within the rules field and setting lang to JAVASCRIPT.
4. The RulesResourceImpl.createRealmRuleset() method receives the request and, due to the lack of validation for JavaScript rules, bypasses the intended Groovy-only restriction.
5. The malicious JavaScript code is then passed to the RulesetStorageService.merge() method and persisted in the REALM_RULESET table.
6. A Hibernate event listener is triggered, publishing a persistence event to a Camel SEDA topic.
7. The RulesService consumes this event and deploys the ruleset, triggering the execution of the attacker-controlled JavaScript code via scriptEngine.eval(script, engineScope) in RulesetDeployment.java L368.
8. The attacker achieves arbitrary code execution on the server, potentially leading to full server compromise, data exfiltration, or other malicious activities.

Impact

Successful exploitation of this vulnerability allows attackers to execute arbitrary code on the OpenRemote server. This can lead to full system compromise, including the ability to steal sensitive data, modify system configurations, or use the compromised server as a launchpad for further attacks. The lack of authentication requirements beyond the write:rules role significantly increases the risk of exploitation. Given the platform's use in IoT environments, the impact could extend to control over physical devices and infrastructure managed by the OpenRemote platform.

Recommendation

• Apply the patch provided by OpenRemote immediately to address the expression injection vulnerabilities (reference: https://github.com/advisories/GHSA-7mqr-33rv-p3mp).
• Monitor web server logs for POST requests to /api/{realm}/rules/realm containing lang: "JAVASCRIPT" in the request body, and investigate any suspicious activity (reference: webserver log monitoring).
• Deploy the Sigma rule provided to detect the creation of JavaScript rulesets, and tune for your environment.
• Implement strict input validation and output encoding for all user-supplied data to prevent expression injection attacks.