[FD] Security advisory: Pre-authentication RCE (default credentials) in ObjectDB 2.9.5 server mode (ObjectDB Software)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in ObjectDB 
2.9.5 server mode (ObjectDB Software). The research is published and a 
proof-of-concept is available.

Pre-authentication RCE (default credentials) (CVSS 9.8, pre-authentication)

ObjectDB 2.9.5 server mode (port 6136, proprietary binary protocol) has a 
critical remote code execution vulnerability: JDOQL query filter evaluation 
allows arbitrary static-method reflective invocation. Factory default 
credentials admin/admin grant full privileges with no forced change; the IP 
check accepts any source IP when the user has no ip attribute. A malicious 
JDOQL filter such as java.lang.Runtime.getRuntime().exec(cmd) != null is 
evaluated server-side: QNF.q() loads any class (no class-name allowlist), 
MCN.l() calls Method.invoke with setAccessible(true), reaching Runtime.exec - 
the server-side Java process runs as root, yielding uid=0(root) RCE. 
Dynamically verified.

Impact: Full read of the host filesystem and JVM environment as root, arbitrary 
OS command execution, and full control of the ObjectDB host and database.

Advisory: https://0day-rubbish.com/blog/objectdb-jdoql-injection-root-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/