CVE-2024-29380: Privilege Escalation Leads to RCE in Medplum

CVE ID: CVE-2024-29380
Loginsoft ID: Loginsoft-2024-1011
Date: March 6, 2024
Severity: High (CVSS 8.8)
CWE: CWE-269 — Improper Privilege Management; CWE-94 — Improper Control of Generation of Code (Code Injection)
Affected: Medplum prior to v3.0.7
Fixed in: v3.0.7
Credit: Saharsh Agrawal (Loginsoft)

🔍 Overview

Medplum is affected by a privilege escalation vulnerability that can lead to the execution of system commands. An attacker with practitioner privileges can elevate their status to a project admin using the ProjectMembership endpoint, enabling them to execute system commands through the bot editor.

🎯 Attack Chain

  1. Create a practitioner with non-admin privileges.
  2. Log in as the practitioner and navigate to the /ProjectMembership endpoint.
  3. Click on the practitioner’s ID and navigate to the edit section.
  4. Scroll to the bottom and enable the admin option.
  5. Submit the request — the practitioner becomes a project administrator.
  6. On reload, the changes are reflected.
  7. Navigate to Project under the admin section, then Bots.
  8. Click on the bot’s name and open the associated link.
  9. Navigate to the editor section, input a payload, and execute the command.

This triggers a system command, leading to the creation of a file in the document folder.

Example Payload

const { exec } = require('child_process');
const path = '/home/ubuntu/Documents';
const command = 'touch RCE';

exec(command, { cwd: path });

💥 Impact

Ability to run arbitrary commands on the system. An attacker can achieve full system compromise through the bot editor after escalating privileges.

🛡️ Mitigation

📅 Timeline

🔗 References