Pwning Your Java Messaging WithDeserialization Vulnerabilities
Matthias Kaiser

About me Head of Vulnerability Research at Code White in Ulm, Germany Software Dev/Architect in the past, enjoying technical security
for 7 years now Specialized on Java Security
 Found bugs in products of Oracle, IBM, VMware, SAP, Redhat,Symantec, Apache, Adobe, etc.
 Recently looking more into the Windows world and client-side stuff@matthias_kaiser

08/03/2016

2

1

Introduction to Java‘s
Native Serialization

23The Java Message Service

4

Attacking JMS

5Introducing JMET6JMET in Action
708/03/2016

MotivationConclusion3

Motivation
 During my research time I looked at all kinds of products running on Java
 Several Java core technologies rely heavily on serialization (RMI, JMX) Furthermore the Java Message Service (JMS) requires the use of Java’s Serialization
 Previous security research on Java Message Service (JMS):
 “A Pentesters Guide to Hacking ActiveMQ Based JMS Applications” + JMSDigger Tool byGursev Singh Kalra of McAfee Foundstone Professional Services (2014)
 “Your Q is my Q” by G. Geshev of MWR InfoSecurity (2014)
 I haven’t found any research on attacking Java Messaging Service using (de)-serialization
 That’s the reason why I’m here

08/03/2016

4

Disclaimer
 This talk continues my research on Java Deserialization Vulnerabilities
 Therefore I won‘t cover all the technical details about finding and exploiting deserialization
vulnerabilities which I have shown in my other talks
 If you want to dig deeper, you should look at:
 “Deserialize My Shorts: Or How I Learned To Start Worrying and Hate Java Object
Deserialization” by Chis Frohoff (OWASP-SD 2016)
 “Serial Killer: Silently Pwning Your Java Endpoint” by Alvaro Muñoz and ChristianSchneider (RSA 2016)
 “Java Deserialization Vulnerabilities - The Forgotten Bug Class” by me (Infiltrate 2016,Ruhrsec 2016)08/03/20165

1

Introduction to Java‘sNative Serialization

2
3The Java Message Service

4

Attacking JMS

5Introducing JMET6JMET in Action
7

08/03/2016

MotivationConclusion

6

What is Serialization?

Deserialization

Serialization

ObjectObjectFile

Database

Network

Stream of Bytes
08/03/2016

7TL;DR Java provides a Serialization API: Serializable classes need to implement interface java.io.Serializable java.io.ObjectOutputStream.writeObject() for writing serializable objects java.io.ObjectInputStream.readObject() for reading serializable objects
 Uses binary protocol for storing an object’s state Deserialization Vulnerability: If untrusted data is read from network, file, database, etc. and used as input for
ObjectInputStream’s readObject()-method
 Exploitation by reusing existing code/classes:
 Serializable classes in the classpath can be abused to write files, trigger dynamic method calls,etc.
 Such classes are called „gadgets“ and were found by researchers in common libraries or evenin JRE classes

08/03/20168

Sometimes it’s as easy as this …

08/03/20169Tool of choice: Ysoserial
 By Chris Frohoff Tool for payload generation
 Public repository for all known gadgets
 Gadgets for Apache Commons Collections
 Apache Commons Beanutils
 Groovy
 JDK<1.7.21
 Beanshell, Jython
 Hibernate
 Spring
 etc.
https://github.com/frohoff/ysoserial/
08/03/201610

1Introduction to Java‘s
Native Serialization

2
3

The Java Message Service

4

Attacking JMS

5Introducing JMET6JMET in Action
708/03/2016

MotivationConclusion

11

The Java Message Service

08/03/2016

12Java Message Service Enterprise Messaging Technology: Message Oriented
Middleware (MOM)
 Included in the Java Platform, Enterprise Edition standard(Java EE) since 1.4, Java EE 7 includes JMS 2.0
 Defines an API for sending and receiving messages
 Does not define the underlying wire protocol (e.g. AMQP) tobe used
 Reference JMS provider implementation for JMS 1.1/JMS 2
Oracle OpenMQ

08/03/2016

13

Products supporting JMS

JEE Application Server


IBM Websphere
Oracle Weblogic
Oracle Glassfish
Redhat EAP/JBOSS/Wildfly
SAP Netweaver AS Java
Apache Geronimo
Apache TomEEetc.

08/03/2016

Message Brokers
 IBM Websphere MQ
 IBM MessageSight(Appliance) Oracle OpenMQ
 Pivotal RabbitMQ
 IIT Software SwiftMQ
 Redhat HornetQ (disc.)
 Apache ActiveMQ (-Artemis) Apache QPID
 etc.

Integration Platforms







IBM Integration Bus
IBM WebSphere ESB
Oracle Service Bus
Redhat JBoss Fuse
Redhat JBoss ESB
Mulesoft Mule ESB
Apache ServiceMix
Apache Camel
etc.

14

JMS Basics

Broker(Queue, Topic)

JMS Client(Producer)

08/03/2016

JMS Client(Consumer)

15

JMS Basics
 JMS Broker
 Runs as a standalone server
 Provides clients with connectivity, message
storage/delivery
 Can be implemented in any language(e.g. Java, Erlang, etc.)
 Maintains destinations (queues and topics)

Broker(Queue, Topic)
JMS Client(Producer)

JMS Client(Consumer) JMS Client A client/serverside application that interacts with a message broker
 Two types  Producer and Consumer
 Connection
 Permanent interaction context with a broker using a specific protocol and credentials
 Session
 Just for transaction management
08/03/2016

16

JMS QueueBroker(Queue)
Producer

08/03/2016

1:1Consumer

17

JMS TopicBroker(Topic)
Publisher

08/03/2016

1: *Subscriber

18

JMS and Wire Protocols
 The wire protocol defines the message structure on a binary level
 JMS doesn’t require a specific wire protocol to be used JMS Providers often use vendor-specific wire protocols
 Several wire protocol standard exists
 AMQP (Advanced Message Queuing Protocol)
 MQTT (MQ Telemetry Transport)
 STOMP (Streaming Text Oriented Messaging Protocol)
 OpenWire
 WebSockets
 etc.

08/03/2016

19

JMS brokers with default ports (no SSL)
VendorTarget

Proprietary

AMQP

OpenWire

MQTT

STOMP

WebSocket

ApacheActiveMQ

x

5672

61616

1883

61613

61614

Redhat/ApacheHornetQ

5445

5672

xx

61613

61614

Oracle

OpenMQ

7676

xxx

7670

7670

IBM

WebSphereMQ

1414

xxxxx

OracleWeblogic

7001

xxxx

x

PivotalRabbitMQ

x

5672

x

1883

61613

15674

IBM

MessageSightxxx

1883,16102

x

x

IIT Software

SwiftMQ

4001

5672

x

x

xx

ApacheActiveMQ Artemis

5445

5672

61616

1883

61613

61614

Apache

QPID

x

5672

xx

x

x

Focus for exploitation using deserialization vulnerabilities
08/03/2016

20

JMS API - Sending a Message

08/03/2016

21

JMS API - Receiving a Message

08/03/2016

22

EJB “Style” - Receiving a Message with a Message Driven Bean

08/03/2016

23

JMS Message Structure
Message
HeaderDestination, Delivery Mode, Return Address, …

Properties

Application Properties

Body

08/03/2016

Application Data

24

JMS Message Types<<interface>>
javax.jms.Message<<interface>>
javax.jms.BytesMessage<<interface>>
javax.jms.MapMessage

08/03/2016<<interface>>
javax.jms.TextMessage<<interface>>
javax.jms.ObjectMessage<<interface>>
javax.jms.StreamMessage

25

JMS Message Types

Source: JMS 1.1 specification
08/03/2016

26

JMS Message Types

08/03/201627

Interface ObjectMessage» Guess what “getObject()”does ;-)08/03/201628

1Introduction to Java‘s
Native Serialization

2
3

The Java Message Service

4

Attacking JMS

5Introducing JMET6JMET in Action
7

08/03/2016

MotivationConclusion

29

Vulnerability Discovery
 Analysis of JMS client libraries of Brokers and Application Servers
 Priority based on what I have seen most often in client engagements
 I haven’t looked at Integration Platforms at all Application Servers reuse brokers/client libraries a lot
 Redhat EAP < 7 (Wildfly < 10) bundles HornetQ
 Redhat EAP >=7 (Wildfly >= 10) bundles ActiveMQ-Artemis
 IBM WebSphere Application Server bundles WebSphereMQ Oracle Glassfish bundles OpenMQ» All ObjectMessage implementations I looked at weredeserializing from untrusted input without any validation

08/03/2016

30

The bug(s) ActiveMQ

08/03/2016

31

The bug(s) ActiveMQ
 HornetQ

08/03/2016

32

The bug(s) ActiveMQ
 HornetQ
 OpenMQ

08/03/2016

33

The bug(s) ActiveMQ
 HornetQ
 OpenMQ
 WebSphereMQ

08/03/2016

34

The bug(s) ActiveMQ
 HornetQ
 OpenMQ
 WebSphereMQ
 Weblogic

08/03/2016

35

The bug(s) ActiveMQ
 HornetQ
 OpenMQ
 WebSphereMQ
 Weblogic RabbitMQ

08/03/2016

36

The bug(s) ActiveMQ
 HornetQ
 OpenMQ
 WebSphereMQ
 Weblogic RabbitMQ
 MessageSight

08/03/2016

37

The bug(s) ActiveMQ
 HornetQ
 OpenMQ
 WebSphereMQ
 Weblogic RabbitMQ
 MessageSight
 SwiftMQ

08/03/2016

38

The bug(s) ActiveMQ
 HornetQ
 OpenMQ
 WebSphereMQ
 Weblogic RabbitMQ
 MessageSight
 SwiftMQ ActiveMQ Artemis

08/03/2016

39

The bug(s) ActiveMQ
 HornetQ
 OpenMQ
 WebSphereMQ
 Weblogic RabbitMQ
 MessageSight
 SwiftMQ ActiveMQ Artemis
 QPid JMS Client

08/03/2016

40

The bug(s) ActiveMQ
 HornetQ
 OpenMQ
 WebSphereMQ
 Weblogic RabbitMQ
 MessageSight
 SwiftMQ ActiveMQ Artemis
 QPid JMS Client QPid Client

08/03/2016

41

The bug(s) ActiveMQ
 HornetQ
 OpenMQ
 WebSphereMQ
 Weblogic RabbitMQ
 MessageSight
 SwiftMQ ActiveMQ Artemis
 QPid JMS Client QPid Client SQS Java Messaging

08/03/2016

42

Vulnerability Patch Status

08/03/2016# VendorTargetVendor Discl.

CVEPatch

1 Apache

ActiveMQ

2015-09-02

CVE-2015-5254

Yes

2 Redhat

HornetQ

2016-03-18

NoNo

3 Oracle

OpenMQ

2016-03-18

No

No

4 IBM

WebSphereMQ

2016-03-18

NoNo

5 Oracle

Weblogic

2016-03-18

CVE-2016-0638

Yes*

6 Pivotal

RabbitMQ

2016-03-24

NoNo

7 IBM

MessageSight

2016-03-24

CVE-2016-0375

Yes

8 IIT Software

SwiftMQ

2016-05-30

NoNo

9 Apache

ActiveMQ Artemis

2016-06-02

NoNo

10 Apache

QPID JMS Client

2016-06-02

CVE-2016-4974

Yes

11 Apache

QPID Client

2016-06-02

CVE-2016-4974

Yes

12 Amazon

SQS Java Messaging

2016-06-14

NoNo

43

Vulnerability Exploitation

08/03/2016

44

Queue Exploitation

Broker(Queue)
Producer

08/03/2016

1:1

Consumer

45

Topic Exploitation

Broker(Topic)
Publisher

08/03/2016

1: *Subscriber

46

Exploitation Success Factors
 Exploitation depends on several factors
 Which JRE version is used
 Which libraries are bundled with the application
 Which libraries are in the classpath of the Runtime Environment (e.g. Application Server)
 Does the Runtime Environment has separate classloaders with limited resolution scope(e.g. OSGI) Is the Java Security Manager enabled (rare!) Since JMS is asynchronous there is no feedback and no error message/stack trace» We need a blackbox assessment tool to send payloads/gadgets!

08/03/201647

1Introduction to Java‘s
Native Serialization

2
3

The Java Message Service

4

Attacking JMS

5Introducing JMET6JMET in Action
7

08/03/2016

MotivationConclusion48

J avaM essage
E xploitation
T ool Command line tool
 Open Source Integrates ysoserial for payload
generation
 Three exploitation modes:
 Gadget XXE
 Custom (using Javascript)
 Customizable using Javascript

https://github.com/matthiaskaiser/jmet

08/03/2016

49

Supported JMS Provider

08/03/2016# VendorTargetSupported

1 Apache

ActiveMQ

2 Redhat/ApacheHornetQ

3 Oracle

OpenMQ



4 IBM

WebSphereMQ

5 Oracle

Weblogic

6 Pivotal

RabbitMQ

7 IBM

MessageSight



8 IIT Software

SwiftMQ

9 Apache

ActiveMQ Artemis

10 Apache

QPID JMS Client

11 Apache

QPID Client

12 Amazon

SQS Java Messaging

50

Gadget mode

08/03/2016

51

1Introduction to Java‘sNative Serialization

23The Java Message Service

4Attacking JMS

5Introducing JMET6JMET in Action
708/03/2016

MotivationConclusion

52

JMET in Action - The Target

08/03/2016

53

Network Node Manager I Overview
 Network Management Software Runs on top of an old JBOSS 5
 HornetQ as JMS-implementation
 Local or LDAP authentication
 Makes heavy use of JMS queues und topics

08/03/2016

54

JMS Attack Surface NNMi
 ~ 150 Message Driven Beans Usage of TextMessage and ObjectMessage
 JBOSS’ HornetQ requires authentication
 Permissions on queues/topics are set explicitly,
otherwise only the “system” user has access

08/03/2016

55

Finding a queue/topic

 There are several queues/topics, an NNMi admin can access So if we have a NNMi admin user, we can send a message to“nms.discovery.configurationPoll”

08/03/2016

56

A vulnerable Message Driven Bean

 There we have our call to ObjectMessage.getObject()

08/03/2016

57

Running JMET against NNMi

08/03/2016

58

Getting SYSTEM calc.exe08/03/201659

1

Introduction to Java‘s
Native Serialization

2
3

The Java Message Service

4Attacking JMS

5Introducing JMET6JMET in Action
708/03/2016

MotivationConclusion

60

Conclusion As with other Java core technologies JMS suffersfrom deserialization vulnerabilities
 All JMS provider implementations were foundvulnerable to missing input validation
 JMS queues/topics can be endpoints for getting
remote code execution
 Successful exploitation depends highly on the“gadgets” in the classpath JMET makes exploitation easy!

08/03/2016

61

Pwning Your Java Messaging WithDeserialization Vulnerabilities
Matthias Kaiser