HipChat Server Security Advisory 2017-03-09

Summary

CVE-2017-5638 - Remote code execution in HipChat Server

Advisory Release Date

  2 PM PST (Pacific Standard Time, -8 hours)

Product HipChat Server
Affected HipChat Server versions
  • Version < 2.2.2
Fixed HipChat Server versions
  • Version 2.2.2 
CVE ID(s)

Summary of Vulnerability

This advisory discloses a critical severity security vulnerability in HipChat Server. All versions of HipChat Server before version 2.2.2 are vulnerable.

                                                       

Hipchat Cloud does not have the issue described on this page. 

Customers who have upgraded HipChat Server to version 2.2.2 or later are not affected.

Customers who have downloaded and installed HipChat Server less than version 2.2.2

Please run the following patch during a maintenance window (it will restart all the services and disconnect all the users)

# Download the patch file
wget https://s3.amazonaws.com/hipchat-server-stable/utils/cve-2017-5638.sh
 
# Check the hash of the file
shasum cve-2017-5638.sh
md5sum cve-2017-5638.sh
 
# Make the file executable
chmod +x cve-2017-5638.sh
 
# Run the patch file
sudo dont-blame-hipchat ./cve-2017-5638.sh

Checksums for cve-2017-5638.sh

  • shasum: c449634e79b38c051a86c7cf50c9233ebcebfde3
  • md5sum: 2c4a117677f3376fe5d5c7a3bb7feab2

Or upgrade your HipChat Server installations immediately to fix this vulnerability.

Apache Struts2 Remote Code Execution (CVE-2017-5638)

Severity

Atlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank a severity as critical, high, moderate, or low.

This is an independent assessment and you should evaluate its applicability to your own IT environment.

Description

HipChat Server includes a version of Crowd that has a version of the Apache Struts 2 library that is vulnerable to CVE-2017-5638. Attackers who have network access to a HipChat Server instance running a vulnerable version of HipChat Server can use this vulnerability to execute Java code of their choice and to make http requests to local & internal services.

All versions of HipChat Server before version 2.2.2 are affected by this vulnerability.

                                                               

Fix

We have taken the following steps to address these issues:

  • Released a patch for customers.
  • Released HipChat Server version 2.2.2 that contains a fix for the issue.

All versions of HipChat Server before version 2.2.2 are affected by this vulnerability. This issue can be tracked here:  HCPUB-2801 - Apache Struts 2 Remote Code Execution (CVE-2017-5638) Closed

What You Need to Do

Upgrade (recommended)

The vulnerability and fix versions are described in the Description section above. Atlassian recommends that you upgrade to the latest version.  

                                                              

Upgrade HipChat Server to version 2.2.2

Information on upgrading HipChat Server can be found at Upgrading HipChat Server

How do I check which version of HipChat Sever I am running?

You can check which version of HipChat Server you are running by going to https://your-server/server_admin/upgrade or by using ssh to log in to your HipChat Server and run cat /etc/hipchat-release.

For a full description of the latest version of HipChat Server, see the release notes.

                               

Detection

Given that we have confirmed exploitation in the wild, we recommend customers look for signs of compromise even if they upgrade immediately. Detection of such attacks is very environment-specific but below are some indicators that customers may find useful in their investigations.

The same expression can be used across all log types, which is especially useful if you are using a SIEM or log aggregator to analyze the logs all at once:

grep -E 'InvalidContentTypeException.+multipart\/form\-data' *.log

If remote code was executed, you will see an OGNL expression being evaluated on the server. These commands will typically start with `#cmd=` or `#cmds=` such as:

(#cmd='ls')
(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd}))

Similar to Crowd, HipChat's embedded Crowd version logs it's logs in `atlassian-crowd.log`.  The default path is `/var/log/hipchat/atlassian-crowd.log`.

017-03-08 11:21:56,410 http-bio-8095-exec-22 WARN [struts2.dispatcher.multipart.JakartaMultiPartRequest] Unable to parse request
org.apache.commons.fileupload.FileUploadBase$InvalidContentTypeException: the request doesn't contain a multipart/form-data or multipart/mixed stream, content type header is %{(#nike='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='touch /tmp/thisisfine').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}
...

                          

Support

If you have questions or concerns regarding this advisory, please raise a support request at https://support.atlassian.com/customer/servicedesk-portal

References

Severity Levels for security issues Atlassian security advisories include a severity level and a CVE identifier. This severity level is based on our self-calculated CVSS score for each specific vulnerability. CVSS is an industry standard vulnerability metric. You can also learn more about CVSS at https://www.first.org/cvss/user-guide.
End-of-Life Policy Our end of life policy varies for different products. Please refer to our EoL Policy for details. 

Was this helpful?

Thanks for your feedback!

Why was this unhelpful?

Have a question about this article?

See questions about this article

Powered by Confluence and Scroll Viewport