Remote Code Execution from any domain account in BizTalk360

 The BizTalk360 solution grants a session to any Windows authenticated user. As the BizTalk360 solution delegates authentication to the IIS server for its WCF (Windows Communication Foundation) services, all accounts of the Active Directory domain can perform requests to these services.

These services are declared on the different svc files stored inside the Web\Services.REST folder, and implemented in the Kovai.BizTalk360.WCFService assembly.

For example, the AlertServiceManagement.svc file declares a service implemented by the AlertService class.

PS > cat "C:\Program Files (x86)\Kovai Ltd\BizTalk360\Web\Services.REST\AlertService.svc"
<%@ ServiceHost Language="C#" Debug="true" Service="Kovai.BizTalk360.WCFService.REST.AlertService" %>

The different endpoints of this service are declared on the parent interface, annotated using the ServiceContract attribute. This interface includes the required HTTP parameters and the expected HTTP verb, for each endpoint defined using the OperationContract attribute on public methods.

namespace Kovai.BizTalk360.BusinessService.WCFContracts
{
    [ServiceContract(Namespace = "http://www.kovai.co.uk/biztalk360/services/1.0")]
    public interface IAlertService
    {
        [OperationContract]
        [WebInvoke(UriTemplate = "/UpdateSMTPSetting", Method = "POST", RequestFormat = WebMessageFormat.Json, ResponseFormat = WebMessageFormat.Json)]
        AlertServiceResponse UpdateSMTPSetting(SMTPSetting smtpSetting);

        [OperationContract]
        [WebGet(UriTemplate = "/GetSMTPSetting", ResponseFormat = WebMessageFormat.Json)]
        GetSMTPSettingResponse GetSMTPSetting();
    // [...]
    }
}

The logic of these endpoints is implemented inside the Kovai.BizTalk360.BusinessService assembly. For example, AlertService relies internally on AlertBusinessService from this assembly.

namespace Kovai.BizTalk360.WCFService.REST
{
    [ServiceBehavior(Namespace = "http://www.kovai.co.uk/biztalk360/services/1.0")]
    [AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Allowed)]
    public class AlertService : IAlertService
    {
        public AlertServiceResponse UpdateSMTPSetting(SMTPSetting smtpSetting)
        {
            AlertServiceResponse alertServiceResponse;
            try
            {
                using (IdentityHelper.GetIdentity().Impersonate())
                {
                    alertServiceResponse = AlertBusinessService.UpdateSMTPSetting(smtpSetting);
                }
            }
            catch (Exception ex)
            {
                alertServiceResponse = new AlertServiceResponse
                {
                    success = false,
                    errors = ExceptionHelper.CreateBaseErrors(ex)
                };
            }
            return alertServiceResponse;
        }
    // [...]
}

Access control is implemented on the application by defining permissions for each operation (i.e. endpoint) and for each role.

These permissions are defined inside the Kovai.BizTalk360.BusinessService.ApiSecurity.APIAccess.xml file, of the Kovai.BizTalk360.BusinessService assembly.

<api-access>
  <available-roles>
    <section name="canAccessOperationSection">
      <role>canAccessTopology</role>
<!-- [...] -->
    <section name="canAccessAnalyticSection">
      <role>canAccessAnalyticMessageFlow</role>
      <role>canAccessAnalyticNewRelic</role>
    </section>
  </available-roles>
  <services>
    <service name="ActivityMonitoringService">
      <operation name="GetAuthorizedAccountsForView">
        <roles condition="and">
          <role>canAccessBAM</role>
        </roles>
      </operation>
<!-- [...] -->

However, these permissions are only enforced on an endpoint if static methods of the ApiSecurityHelper class are manually invoked before performing each operation.

For example, access control is enforced on the GetNotificationChannels endpoint of AlertBusinessService:

public static GetNotificationChannelsResponse GetNotificationChannels()
{
    MethodExecutionArgs methodExecutionArgs = new MethodExecutionArgs(null, null);
    GetNotificationChannelsResponse getNotificationChannelsResponse;
    // Enforcing access controls:
    ApiSecurityHelper.ValidateNotificationChannelsApiValidation(AlertServiceOperation.GetNotificationChannels);
    NotificationChannelList notificationChannels = AlertServiceManagement.GetNotificationChannels();
    getNotificationChannelsResponse = new GetNotificationChannelsResponse
    {
        success = true,
        channels = notificationChannels
    };
    return getNotificationChannelsResponse;
}

Arbitrary DLL load

Among the features implemented by this service, which are not subject to permission checks, a user can provide a path to a dynamic library (DLL file), which is then loaded by the application, through the /ValidateNotificationChannel endpoint.

Indeed, in the AlertServiceManagement class, the ValidateNotificationChannel method uses a user-provided argument without prior verification (dllName) to build the path of the DLL file to be loaded.

internal static NotificationChannel ValidateNotificationChannel(ValidateNotificationChannelRequest request, out bool isValidNotificationChannel, bool isDefaultLoad = false, string defalutPath = "") 
{
    string text = string.Empty;
    // [...]
    string libraryPath = Path.Combine(new string[] {
        AlertServiceManagement.basePath + "Download\\NotificationChannels\\Dll\\" + request.dllName
    });
    isValidNotificationChannel = true;
    string result;
    AlertServiceManagement.ManageDllExtractions(isDefaultLoad ? defalutPath : libraryPath, out result, out text);
    // [...]
}

The invoked method ManageDllExtractions of the AlertServiceManagement class then tries to load a DLL from this path. If the loaded assembly includes a class implementing the IChannelNotification interface, it is instantiated.

Arbitrary DLL upload

Moreover, an authenticated user can upload a dynamic library (DLL file) through the /UploadFile endpoint of AnalyticsDataService.

Indeed, this feature is implemented on the AnalyticsDataBusinessService class, where no access control is enforced.

namespace Kovai.BizTalk360.BusinessService.Main.Rest
{
    public class AnalyticsDataBusinessService
    {
        public static FileUploadResponse UploadFile(Stream fileStream, string fileName, FileUpload fileUploadSection)
        {
            // [...]
            bool isMimeTypeValid = AnalyticsDataBusinessService.checkMimeType(FileUploadHelper.GetMime(array), fileUploadSection);
            // [...]
            switch (fileUploadSection)
            {
                // [...]
                case FileUpload.NotificationChannelDll:
                    text2 = Constants.NotificationChannelsFilePath;
                    fileNameExtensionIsValid = extension.Contains("dll");
                    break;
                // [...]
            }
            // [...]
            FileUploadResponse fileUploadResponse = new FileUploadResponse();
            if (fileNameExtensionIsValid && isMimeTypeValid)
            {
                // [...] save provided file to path [...]
                fileUploadResponse.file = new UploadedFile
                {
                    fileUploadSection = fileUploadSection,
                    fileName = fileName,
                    fileLength = Convert.ToString(num)
                };
            }
            // [...]
            return fileUploadResponse;
        }
        // [...]
    }
}

The BizTalk360 solution uses the Path.Combine method to build file paths from user-provided input.

However, as demonstrated bellow, the final path can be different depending on the second argument supplied to the Path.Combine method:

Path.Combine(@"C:\BizTalk360\web\upload", @"file.png");  // C:\BizTalk360\web\upload\file.png
Path.Combine(@"C:\BizTalk360\web\upload", @"..\file.png");  // C:\BizTalk360\web\upload\..\file.png
Path.Combine(@"C:\BizTalk360\web\upload", @"\file.png");  // \file.png
Path.Combine(@"C:\BizTalk360\web\upload", @"D:\file.png");  // D:\file.png
Path.Combine(@"C:\BizTalk360\web\upload", @"\\LAB\SYSVOL\file.png"); // \\LAB\SYSVOL\file.png

In the AnalyticsDataBusinessService class of the Kovai.BizTalk360.BusinessService assembly, the UploadFile method uses Path.Combine to build the destination path, using the user-provided fileName parameter as a second argument.

public static FileUploadResponse UploadFile(Stream fileStream, string fileName, FileUpload fileUploadSection) {
    // [...]
    if (uploadType.Contains("notification-channels") || uploadType.Contains("custom-widgets")) {
        baseDirectory = [...]; // Get base directory from uploadType
        destinationFilePath = Path.Combine(baseDirectory, fileName); // Build destination path
    } else {
        destinationFilePath = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, uploadType, fileName); // Build destination path
    }
    if (flag2 && flag)    {
        using (FileStream fileStream2 = new FileStream(destinationFilePath, FileMode.Create))
        {
             // [...] Writes content to destinationFilePath [...] 
        }
    // [...]
}

Synacktiv did not perform a full review of the BizTalk360 components, therefore other endpoints may be affected by this vulnerability.

Nonetheless, the ValidateNotificationChanel endpoint of AlertService is also affected by the path traversal vulnerability:

internal static NotificationChannel ValidateNotificationChannel(ValidateNotificationChannelRequest request, out bool isValidNotificationChannel, bool isDefaultLoad = false, string defalutPath = "") 
{
    // [...]
    string libraryPath = Path.Combine(new string[] {
        AlertServiceManagement.basePath + "Download\\NotificationChannels\\Dll\\" + request.dllName
    });
    // [...]
}

The BizTalk360 application provides a download feature to administrators, without performing sufficient controls.

Indeed, the DownloadAttachment handler of AdminBusinessService, allows any authenticated administrator to download arbitrary files, by providing an absolute path on the attachmentLink parameter.

public static Stream DownloadAttachment(string server, string featureName, string attachmentName, string attachmentLink) {
    // [...]
    try {
        // [...]
        string filePath = attachmentLink ?? "";
        Stream stream2;
        try {
            if (string.IsNullOrEmpty(attachmentLink)) {
                throw new Exception("Attachment Link is Empty");
            }
            if (File.Exists(filePath)) {
                Stream stream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.Read);
                WebOperationContext.Current.OutgoingResponse.ContentType = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
                WebOperationContext.Current.OutgoingResponse.Headers["Content-Disposition"] = "attachment; filename=" + (attachmentName ?? string.Empty);
                stream2 = stream;
                goto IL_0122;
            }
    // [...]
}