9e9bf495c2
26 new exploits
PHP 5.4.0RC6 (x64t) - Denial of Service
PHP 5.4.0RC6 (x64) - Denial of Service
Evostream Media Server 1.7.1 (x64) - Denial of Service
PrivateTunnel Client 2.8 - Local Buffer Overflow (SEH)
VirtualBox - Environment and ioctl Unprivileged Host User to Host Kernel Privilege Escalation
VirtualBox - 'virtio-net' Guest-to-Host Out-of-Bounds Write
Dmitry 1.3a - Local Buffer Overflow
Oracle VM VirtualBox - Environment and ioctl Unprivileged Host User to Host Kernel Privilege Escalation
Oracle VM VirtualBox - 'virtio-net' Guest-to-Host Out-of-Bounds Write
Apple Safari - Array concat Memory Corruption
Oracle VirtualBox Guest Additions 5.1.18 - Unprivileged Windows User-Mode Guest Code Double-Free
VirtualBox - Cooperating VMs can Escape from Shared Folder
PCAUSA Rawether (ASUS PCE-AC56 WLAN Card Utilities Windows 10 x64) - Privilege Escalation
Oracle VM VirtualBox - Cooperating VMs can Escape from Shared Folder
PCAUSA Rawether (ASUS PCE-AC56 WLAN Card Utilities Windows 10 x64) - Privilege Escalation
VirtualBox - Guest-to-Host Privilege Escalation via Broken Length Handling in slirp Copy
VirtualBox 5.1.14 r112924 - Unprivileged Host User to Host Kernel Privilege Escalation via ALSA config
VirtualBox 5.0.32 r112930 x64 - Windows Process COM Injection Privilege Escalation
Oracle VM VirtualBox - Guest-to-Host Privilege Escalation via Broken Length Handling in slirp Copy
Oracle VM VirtualBox 5.1.14 r112924 - Unprivileged Host User to Host Kernel Privilege Escalation via ALSA config
Oracle VM VirtualBox 5.0.32 r112930 (x64) - Windows Process COM Injection Privilege Escalation
Dell Customer Connect 1.3.28.0 - Privilege Escalation
LightDM (Ubuntu 16.04/16.10) - Guest Account Local Privilege Escalation
Realtek Audio Driver 6.0.1.7898 (Windows 10) - Dolby Audio X2 Service Privilege Escalation
Nginx 1.4.0 (x64) (Generic Linux) - Remote Exploit
Nginx 1.4.0 (Generic Linux x64) - Remote Exploit
Microsoft Windows 2003 SP2 - 'ERRATICGOPHER' SMB Remote Code Execution
Microsoft Office Word - Malicious Hta Execution (Metasploit)
WePresent WiPG-1000 - Command Injection (Metasploit)
OSX/Intel - setuid shell x86_64 Shellcode (51 bytes)
OSX/Intel (x86-64) - setuid shell Shellcode (51 bytes)
OSX/Intel (x86_64) - reverse_tcp shell Shellcode (131 bytes)
OSX/Intel (x86-64) - reverse_tcp shell Shellcode (131 bytes)
Linux x86 / x86_64 - reverse_tcp (192.168.1.29:4444) Shellcode (195 bytes)
Linux x86 / x86_64 - tcp_bind (Port 4444) Shellcode (251 bytes)
Linux x86 / x86_64 - Read /etc/passwd Shellcode (156 bytes)
Linux x86/x86-64 - reverse_tcp (192.168.1.29:4444) Shellcode (195 bytes)
Linux x86/x86-64 - tcp_bind (Port 4444) Shellcode (251 bytes)
Linux x86/x86-64 - Read /etc/passwd Shellcode (156 bytes)
Linux/Windows/BSD x86_64 - execve(_/bin//sh__ {_//bin/sh__ _-c__ _cmd_}_ NULL) Execute Command Shellcode (194 bytes)
Linux/Windows/BSD x86-64 - execve(_/bin//sh__ {_//bin/sh__ _-c__ _cmd_}_ NULL) Execute Command Shellcode (194 bytes)
Linux/x86-64 - Egghunter Shellcode (38 bytes)
Linux/x86-64 - Reverse Shell Shellcode (84 bytes)
FlySpray 1.0-rc4 - Cross-Site Scripting / Cross-Site Request Forgery
WordPress Plugin KittyCatfish 2.2 - SQL Injection
WordPress Plugin Car Rental System 2.5 - SQL Injection
WordPress Plugin Wow Viral Signups 2.1 - SQL Injection
WordPress Plugin Wow Forms 2.1 - SQL Injection
Oracle PeopleSoft - 'PeopleSoftServiceListeningConnector' XML External Entity via DOCTYPE
Oracle E-Business Suite 12.2.3 - 'IESFOOTPRINT' SQL Injection
HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusion
OpenText Documentum Content Server - dm_bp_transition.ebs docbase Method Arbitrary Code Execution
Joomla Component Myportfolio 3.0.2 - 'pid' Parameter SQL Injection
October CMS 1.0.412 - Multiple Vulnerabilities
143 lines
No EOL
4.9 KiB
Text
Executable file
143 lines
No EOL
4.9 KiB
Text
Executable file
Application: Oracle PeopleSoft
|
||
Versions Affected: PeopleSoft HCM 9.2 on PeopleTools 8.55
|
||
Vendor URL: http://oracle.com
|
||
Bug: XXE
|
||
Reported: 23.12.2016
|
||
Vendor response: 24.12.2016
|
||
Date of Public Advisory: 18.04.2017
|
||
Reference: Oracle CPU April 2017
|
||
Author: Nadya Krivdyuk (ERPScan)
|
||
|
||
|
||
Description
|
||
|
||
1. ADVISORY INFORMATION
|
||
Title:[ERPSCAN-17-020] XXE VIA DOCTYPE in PeopleSoft
|
||
PeopleSoftServiceListeningConnector
|
||
Advisory ID: [ERPSCAN-17-020]
|
||
Risk: high
|
||
CVE: CVE-2017-3548
|
||
Advisory URL: https://erpscan.com/advisories/erpscan-17-020-xxe-via-doctype-peoplesoft/
|
||
Date published: 18.04.2017
|
||
Vendors contacted: Oracle
|
||
|
||
|
||
2. VULNERABILITY INFORMATION
|
||
|
||
Class: XXE
|
||
Impact: File disclosure, network discovery
|
||
Remotely Exploitable: yes
|
||
Locally Exploitable: no
|
||
|
||
CVSS Information
|
||
CVSS Base Score v3: 8.0 / 10
|
||
CVSS Base Vector:
|
||
AV : Attack Vector (Related exploit range) Network (N)
|
||
AC : Attack Complexity (Required attack complexity) High (H)
|
||
PR : Privileges Required (Level of privileges needed to exploit) High (H)
|
||
UI : User Interaction (Required user participation) None (N)
|
||
S : Scope (Change in scope due to impact caused to components beyond
|
||
the vulnerable component) Changed (C)
|
||
C : Impact to Confidentiality High (H)
|
||
I : Impact to Integrity High (H)
|
||
A : Impact to Availability High (H)
|
||
|
||
3. VULNERABILITY DESCRIPTION
|
||
|
||
A malicious user can modify an XML-based request to include XML
|
||
content that is then parsed locally.
|
||
|
||
4. VULNERABLE PACKAGES
|
||
|
||
PeopleSoft HCM 9.2 on PeopleTools 8.55
|
||
|
||
5. SOLUTIONS AND WORKAROUNDS
|
||
|
||
To correct this vulnerability, implement Oracle CPU April 2017
|
||
|
||
6. AUTHOR
|
||
|
||
Nadya Krivdyuk
|
||
|
||
|
||
7. TECHNICAL DESCRIPTION
|
||
|
||
An attacker can use an XML external entity vulnerability to send
|
||
specially crafted unauthorized XML requests, which will be processed
|
||
by the XML parser. The attacker can use an XML external entity
|
||
vulnerability for getting unauthorised access to the OS file system.
|
||
|
||
PoC
|
||
|
||
|
||
POST /PSIGW/PeopleSoftServiceListeningConnector HTTP/1.1
|
||
Host: 172.16.2.91:8000
|
||
Content-type: text/xml
|
||
<!DOCTYPE a PUBLIC "-//B/A/EN" "C:\windows">
|
||
|
||
8. ABOUT ERPScan Research
|
||
|
||
ERPScan research team specializes in vulnerability research and
|
||
analysis of critical enterprise applications. It was acknowledged
|
||
multiple times by the largest software vendors like SAP, Oracle,
|
||
Microsoft, IBM, VMware, HP for discovering more than 400
|
||
vulnerabilities in their solutions (200 of them just in SAP!).
|
||
|
||
ERPScan researchers are proud of discovering new types of
|
||
vulnerabilities (TOP 10 Web Hacking Techniques 2012) and of the "The
|
||
Best Server-Side Bug" nomination at BlackHat 2013.
|
||
|
||
ERPScan experts participated as speakers, presenters, and trainers at
|
||
60+ prime international security conferences in 25+ countries across
|
||
the continents ( e.g. BlackHat, RSA, HITB) and conducted private
|
||
trainings for several Fortune 2000 companies.
|
||
|
||
ERPScan researchers carry out the EAS-SEC project that is focused on
|
||
enterprise application security awareness by issuing annual SAP
|
||
security researches.
|
||
|
||
ERPScan experts were interviewed in specialized info-sec resources and
|
||
featured in major media worldwide. Among them there are Reuters,
|
||
Yahoo, SC Magazine, The Register, CIO, PC World, DarkReading, Heise,
|
||
Chinabyte, etc.
|
||
|
||
Our team consists of highly-qualified researchers, specialized in
|
||
various fields of cybersecurity (from web application to ICS/SCADA
|
||
systems), gathering their experience to conduct the best SAP security
|
||
research.
|
||
|
||
9. ABOUT ERPScan
|
||
|
||
ERPScan is the most respected and credible Business Application
|
||
Cybersecurity provider. Founded in 2010, the company operates globally
|
||
and enables large Oil and Gas, Financial, Retail and other
|
||
organizations to secure their mission-critical processes. Named as an
|
||
‘Emerging Vendor’ in Security by CRN, listed among “TOP 100 SAP
|
||
Solution providers” and distinguished by 30+ other awards, ERPScan is
|
||
the leading SAP SE partner in discovering and resolving security
|
||
vulnerabilities. ERPScan consultants work with SAP SE in Walldorf to
|
||
assist in improving the security of their latest solutions.
|
||
|
||
ERPScan’s primary mission is to close the gap between technical and
|
||
business security, and provide solutions for CISO's to evaluate and
|
||
secure SAP and Oracle ERP systems and business-critical applications
|
||
from both cyberattacks and internal fraud. As a rule, our clients are
|
||
large enterprises, Fortune 2000 companies and MSPs, whose requirements
|
||
are to actively monitor and manage security of vast SAP and Oracle
|
||
landscapes on a global scale.
|
||
|
||
We ‘follow the sun’ and have two hubs, located in Palo Alto and
|
||
Amsterdam, to provide threat intelligence services, continuous support
|
||
and to operate local offices and partner network spanning 20+
|
||
countries around the globe.
|
||
|
||
|
||
|
||
|
||
Address USA: 228 Hamilton Avenue, Fl. 3, Palo Alto, CA. 94301
|
||
|
||
Phone: 650.798.5255
|
||
|
||
Twitter: @erpscan
|
||
|
||
Scoop-it: Business Application Security |