Authenticated Command Execution in Appsmith via Supervisord XML-RPC

Executive Summary

This vulnerability affects Appsmith versions prior to 2.1. The issue arises because Appsmith's bundled supervisord exposes an XML-RPC interface on port 9001, which is accessible from outside the container through a Caddy reverse-proxy route at /supervisor/* on the public ingress.

Additionally, the APPSMITH_SUPERVISOR_PASSWORD is exposed via a GET request to /api/v1/admin/env. This means that any authenticated administrator can send arbitrary XML-RPC calls to supervisord and execute operating system commands inside the Docker container using the twiddler.addProgramToGroup method.

This vulnerability allows for remote command execution within the container, which is a serious security risk. The issue was fixed in Appsmith version 2.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have significant impacts including unauthorized execution of operating system commands inside the Docker container running Appsmith.

An authenticated administrator could exploit this to run arbitrary commands, potentially leading to data compromise, service disruption, or further escalation of privileges within the environment.

Because the XML-RPC interface is exposed publicly via the reverse proxy, it increases the attack surface and risk of exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Appsmith version 2.1. Immediate mitigation involves upgrading Appsmith to version 2.1 or later.

Additionally, restricting access to the supervisord XML-RPC interface on port 9001 and the /supervisor/* route exposed via the Caddy reverse-proxy can help reduce exposure.

Ensure that the APPSMITH_SUPERVISOR_PASSWORD is not exposed via the GET /api/v1/admin/env endpoint to prevent unauthorized authenticated administrators from exploiting the vulnerability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated administrator to execute arbitrary OS commands within the Docker container, potentially leading to unauthorized access, data manipulation, or system compromise.

Such unauthorized access and potential data breaches could impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and system security.

Because the vulnerability affects confidentiality, integrity, and availability, organizations using affected versions of Appsmith may face increased risk of non-compliance if exploited.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the supervisord XML-RPC interface is exposed on port 9001 and accessible externally via the Caddy reverse-proxy route at /supervisor/*. Additionally, verifying if the APPSMITH_SUPERVISOR_PASSWORD is accessible through the admin-only endpoint GET /api/v1/admin/env can indicate susceptibility.

Suggested commands to detect exposure include:

• Use a network scanning tool like nmap to check if port 9001 is open and reachable: nmap -p 9001 <target-ip>
• Attempt to access the supervisord XML-RPC interface via HTTP to see if it responds: curl http://<target-ip>:9001/RPC2
• Check if the Caddy reverse-proxy route is exposing the interface publicly: curl http://<target-domain>/supervisor/
• Verify if the APPSMITH_SUPERVISOR_PASSWORD is exposed by querying the admin environment endpoint (requires admin authentication): curl -H "Authorization: Bearer <admin-token>" http://<target-domain>/api/v1/admin/env

Useful 0 Not Useful 0