143 lines
No EOL
4.7 KiB
Text
143 lines
No EOL
4.7 KiB
Text
Application: Oracle PeopleSoft
|
||
Versions Affected: PeopleSoft HCM 9.2 on PeopleTools 8.55
|
||
Vendor URL: http://oracle.com
|
||
Bug: XXE
|
||
Reported: 23.12.2016
|
||
Vendor response: 24.12.2016
|
||
Date of Public Advisory: 18.04.2017
|
||
Reference: Oracle CPU April 2017
|
||
Author: Nadya Krivdyuk (ERPScan)
|
||
|
||
|
||
Description
|
||
|
||
1. ADVISORY INFORMATION
|
||
Title:[ERPSCAN-17-020] XXE VIA DOCTYPE in PeopleSoft
|
||
PeopleSoftServiceListeningConnector
|
||
Advisory ID: [ERPSCAN-17-020]
|
||
Risk: high
|
||
CVE: CVE-2017-3548
|
||
Advisory URL: https://erpscan.com/advisories/erpscan-17-020-xxe-via-doctype-peoplesoft/
|
||
Date published: 18.04.2017
|
||
Vendors contacted: Oracle
|
||
|
||
|
||
2. VULNERABILITY INFORMATION
|
||
|
||
Class: XXE
|
||
Impact: File disclosure, network discovery
|
||
Remotely Exploitable: yes
|
||
Locally Exploitable: no
|
||
|
||
CVSS Information
|
||
CVSS Base Score v3: 8.0 / 10
|
||
CVSS Base Vector:
|
||
AV : Attack Vector (Related exploit range) Network (N)
|
||
AC : Attack Complexity (Required attack complexity) High (H)
|
||
PR : Privileges Required (Level of privileges needed to exploit) High (H)
|
||
UI : User Interaction (Required user participation) None (N)
|
||
S : Scope (Change in scope due to impact caused to components beyond
|
||
the vulnerable component) Changed (C)
|
||
C : Impact to Confidentiality High (H)
|
||
I : Impact to Integrity High (H)
|
||
A : Impact to Availability High (H)
|
||
|
||
3. VULNERABILITY DESCRIPTION
|
||
|
||
A malicious user can modify an XML-based request to include XML
|
||
content that is then parsed locally.
|
||
|
||
4. VULNERABLE PACKAGES
|
||
|
||
PeopleSoft HCM 9.2 on PeopleTools 8.55
|
||
|
||
5. SOLUTIONS AND WORKAROUNDS
|
||
|
||
To correct this vulnerability, implement Oracle CPU April 2017
|
||
|
||
6. AUTHOR
|
||
|
||
Nadya Krivdyuk
|
||
|
||
|
||
7. TECHNICAL DESCRIPTION
|
||
|
||
An attacker can use an XML external entity vulnerability to send
|
||
specially crafted unauthorized XML requests, which will be processed
|
||
by the XML parser. The attacker can use an XML external entity
|
||
vulnerability for getting unauthorised access to the OS file system.
|
||
|
||
PoC
|
||
|
||
|
||
POST /PSIGW/PeopleSoftServiceListeningConnector HTTP/1.1
|
||
Host: 172.16.2.91:8000
|
||
Content-type: text/xml
|
||
<!DOCTYPE a PUBLIC "-//B/A/EN" "C:\windows">
|
||
|
||
8. ABOUT ERPScan Research
|
||
|
||
ERPScan research team specializes in vulnerability research and
|
||
analysis of critical enterprise applications. It was acknowledged
|
||
multiple times by the largest software vendors like SAP, Oracle,
|
||
Microsoft, IBM, VMware, HP for discovering more than 400
|
||
vulnerabilities in their solutions (200 of them just in SAP!).
|
||
|
||
ERPScan researchers are proud of discovering new types of
|
||
vulnerabilities (TOP 10 Web Hacking Techniques 2012) and of the "The
|
||
Best Server-Side Bug" nomination at BlackHat 2013.
|
||
|
||
ERPScan experts participated as speakers, presenters, and trainers at
|
||
60+ prime international security conferences in 25+ countries across
|
||
the continents ( e.g. BlackHat, RSA, HITB) and conducted private
|
||
trainings for several Fortune 2000 companies.
|
||
|
||
ERPScan researchers carry out the EAS-SEC project that is focused on
|
||
enterprise application security awareness by issuing annual SAP
|
||
security researches.
|
||
|
||
ERPScan experts were interviewed in specialized info-sec resources and
|
||
featured in major media worldwide. Among them there are Reuters,
|
||
Yahoo, SC Magazine, The Register, CIO, PC World, DarkReading, Heise,
|
||
Chinabyte, etc.
|
||
|
||
Our team consists of highly-qualified researchers, specialized in
|
||
various fields of cybersecurity (from web application to ICS/SCADA
|
||
systems), gathering their experience to conduct the best SAP security
|
||
research.
|
||
|
||
9. ABOUT ERPScan
|
||
|
||
ERPScan is the most respected and credible Business Application
|
||
Cybersecurity provider. Founded in 2010, the company operates globally
|
||
and enables large Oil and Gas, Financial, Retail and other
|
||
organizations to secure their mission-critical processes. Named as an
|
||
‘Emerging Vendor’ in Security by CRN, listed among “TOP 100 SAP
|
||
Solution providers” and distinguished by 30+ other awards, ERPScan is
|
||
the leading SAP SE partner in discovering and resolving security
|
||
vulnerabilities. ERPScan consultants work with SAP SE in Walldorf to
|
||
assist in improving the security of their latest solutions.
|
||
|
||
ERPScan’s primary mission is to close the gap between technical and
|
||
business security, and provide solutions for CISO's to evaluate and
|
||
secure SAP and Oracle ERP systems and business-critical applications
|
||
from both cyberattacks and internal fraud. As a rule, our clients are
|
||
large enterprises, Fortune 2000 companies and MSPs, whose requirements
|
||
are to actively monitor and manage security of vast SAP and Oracle
|
||
landscapes on a global scale.
|
||
|
||
We ‘follow the sun’ and have two hubs, located in Palo Alto and
|
||
Amsterdam, to provide threat intelligence services, continuous support
|
||
and to operate local offices and partner network spanning 20+
|
||
countries around the globe.
|
||
|
||
|
||
|
||
|
||
Address USA: 228 Hamilton Avenue, Fl. 3, Palo Alto, CA. 94301
|
||
|
||
Phone: 650.798.5255
|
||
|
||
Twitter: @erpscan
|
||
|
||
Scoop-it: Business Application Security |