CVE-2020-7378

CVE-2020-7378 – OpenCRX Predictable Password Reset Token and XXE Exploit

This repository contains a combined proof-of-concept (PoC) exploit for CVE-2020-7378, a critical vulnerability in OpenCRX (versions up to and including 5.0-20200717). The exploit chains two core issues in the application:

1. A predictable password reset token vulnerability due to reliance on java.util.Random, which allows attackers to generate valid tokens based on a millisecond timestamp seed.
2. A blind XML External Entity (XXE) vulnerability in the RestServlet endpoint that permits remote file disclosure from the server’s filesystem.

The combination of these two flaws enables an unauthenticated attacker to gain administrative access and exfiltrate sensitive server-side files.

---

Vulnerability Details

• CVE ID: CVE-2020-7378

• Affected Product: OpenCRX ≤ 5.0-20200717

• Attack Surface: Publicly exposed management and REST interfaces

• Root Causes:

  • Insecure pseudo-random token generation during password resets
  • Unsafe XML parsing in REST API endpoints

• Impact:

  • Unauthorized password resets for arbitrary users (including admin)
  • Arbitrary file read via XXE injection

• CVSS: 9.1 (Critical)

---

Included Components

• opencrx-exploit.py: Full-chain exploit script that performs both token prediction and XXE file read.
• OpenCRXToken.java: Java class that emulates the token generation logic using a brute-force seed range based on request timing.

Usage

1. Compile the token generator:

   root@kitploit:~

   javac OpenCRXToken.java
   

2. Run the exploit:

   root@kitploit:~

   python3 opencrx-exploit.py <target_user_id>
   

This will:

• Generate and test valid password reset tokens based on the timing window.
• Reset the target user’s password.
• Trigger an XXE payload via the REST API to read a sensitive file from the server.