CVE-2020-26565
📋 TL;DR
CVE-2020-26565 is an expression language injection vulnerability in ObjectPlanet Opinio's admin/permissionList.do endpoint that allows attackers to execute arbitrary code on the server. This can lead to sensitive data exposure, including serverInfo data. Organizations running Opinio versions before 7.14 are affected.
💻 Affected Systems
- ObjectPlanet Opinio
📦 What is this software?
Opinio by Objectplanet
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing remote code execution, data exfiltration, and lateral movement within the network.
Likely Case
Unauthorized access to sensitive server configuration data and potential privilege escalation.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation attempts.
🎯 Exploit Status
Exploitation requires admin access to the Opinio interface. Public proof-of-concept demonstrates data extraction via expression language injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.14 and later
Vendor Advisory: https://www.objectplanet.com/opinio/changelog.html
Restart Required: Yes
Instructions:
1. Download Opinio version 7.14 or later from ObjectPlanet website. 2. Backup current installation and configuration. 3. Stop Opinio service. 4. Install the updated version. 5. Restart Opinio service. 6. Verify functionality.
🔧 Temporary Workarounds
Restrict Admin Access
allLimit access to the admin interface to trusted IP addresses only
# Configure firewall rules to restrict access to Opinio admin port
# Example: iptables -A INPUT -p tcp --dport [OPINIO_PORT] -s [TRUSTED_IP] -j ACCEPT
# iptables -A INPUT -p tcp --dport [OPINIO_PORT] -j DROP
Disable Vulnerable Endpoint
allBlock access to the specific vulnerable endpoint via web server configuration
# Apache: <Location "/admin/permissionList.do">
# Order deny,allow
# Deny from all
# </Location>
# Nginx: location /admin/permissionList.do { return 403; }
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Opinio servers from sensitive systems
- Enable detailed logging and monitoring for suspicious access to admin/permissionList.do endpoint
🔍 How to Verify
Check if Vulnerable:
Check Opinio version via admin interface or configuration files. If version is below 7.14, the system is vulnerable.Check Version:
Check web interface footer or examine installation directory for version informationVerify Fix Applied:
Verify version is 7.14 or higher and test that expression language injection attempts to permissionList.do endpoint are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to /admin/permissionList.do
- Expression language payloads in URL parameters
- Multiple failed authentication attempts followed by successful admin login
Network Indicators:
- HTTP requests containing expression language syntax (${, #{}) to admin endpoints
- Unusual outbound connections from Opinio server
SIEM Query:
source="opinio_access.log" AND (uri="/admin/permissionList.do" OR uri CONTAINS "permissionList.do") AND (query CONTAINS "${*}" OR query CONTAINS "#{*}")🔗 References
- https://packetstormsecurity.com/files/163708/ObjectPlanet-Opinio-7.13-Expression-Language-Injection.html
- https://www.objectplanet.com/opinio/changelog.html
- https://packetstormsecurity.com/files/163708/ObjectPlanet-Opinio-7.13-Expression-Language-Injection.html
- https://www.objectplanet.com/opinio/changelog.html
