exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Libraptor XXE In RDF/XML File Interpretation

Libraptor XXE In RDF/XML File Interpretation
Posted Mar 24, 2012
Authored by Timothy D. Morgan | Site vsecurity.com

VSR identified a vulnerability in multiple open source office products (including OpenOffice, LibreOffice, KOffice, and AbiWord) due to unsafe interpretation of XML files with custom entity declarations. Deeper analysis revealed that the vulnerability was caused by acceptance of external entities by the libraptor library, which is used by librdf and is in turn used by these office products.

tags | advisory
advisories | CVE-2012-0037
SHA-256 | c080c190d86a9fe75c277115920d4c554a70b66f10a4c4abc47cf7b1079c5232

Libraptor XXE In RDF/XML File Interpretation

Change Mirror Download
Hash: SHA1

VSR Security Advisory


Advisory Name: libraptor - XXE in RDF/XML File Interpretation
Release Date: 2012-03-24
Applications: libraptor / librdf (versions 1.x and 2.x)
Also Affected: OpenOffice 3.x, LibreOffice 3.x, AbiWord, KOffice
Author: tmorgan {a} vsecurity * com
Vendor Status: Patches available; major downstream vendors
and operating system distributions notified
CVE Candidate: CVE-2012-0037
Reference: http://www.vsecurity.com/resources/advisory/20120324-1/


Product Description
"Raptor is a free software / Open Source C library that provides a set of
parsers and serializers that generate Resource Description Framework (RDF)
triples by parsing syntaxes or serialize the triples into a syntax. The
supported parsing syntaxes are RDF/XML, N-Quads, N-Triples, TRiG, Turtle, RSS
tag soup including all versions of RSS, Atom 1.0 and 0.3, GRDDL and
microformats for HTML, XHTML and XML and RDFa. The serializing syntaxes are
RDF/XML (regular, and abbreviated), Atom 1.0, GraphViz, JSON, N-Quads,
N-Triples, RSS 1.0 and XMP." -- libraptor web site [1]

libraptor is a component of librdf[2] which is used by a variety of open source
software to interpret Resource Description Framework (RDF) [3] formats.

Vulnerability Overview
In December 2011, VSR identified a vulnerability in multiple open source office
products (including OpenOffice, LibreOffice, KOffice, and AbiWord) due to unsafe
interpretation of XML files with custom entity declarations. Deeper analysis
revealed that the vulnerability was caused by acceptance of external entities by
the libraptor library, which is used by librdf and is in turn used by these
office products.

In the context of office applications, these vulnerabilities could allow for XML
External Entity (XXE) attacks resulting in file theft and a loss of user privacy
when opening potentially malicious ODF documents. For other applications which
depend on librdf or libraptor, potentially serious consequences could result
from accepting RDF/XML content from untrusted sources, though the impact may
vary widely depending on the context.

Vulnerability Details
Open Document Format (ODF) files consist of a collection of several different
files stored in a ZIP archive. Included in this set is a "manifest.rdf" file
which is formatted according to the RDF/XML representation. The RDF format is
intended to be used for storing metadata associated with specific document
elements. The manifest.rdf file can reference secondary RDF files within the
ODF file as well as external document schemas.

The RDF file parser (librdf) used by the affected office products allows DTD
specifications within the RDF files themselves. In addition, the parser
interprets external entities which may reference arbitrary external files, HTTP
and FTP resources.

For instance, the following "evil.rdf" file was created within a valid ODF text
archive (.odt file) which was referenced by the internal manifest.rdf file:

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE rdf [
<!ENTITY file SYSTEM "file:///c:/windows/win.ini">
<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
<rdf:Description rdf:about="content.xml#id1265690860">

Upon opening the malicious .odt file in OpenOffice for Windows, the
c:\windows\win.ini file was read and included in the document metadata. Upon
saving the document, this metadata was included literally in the resulting
evil.rdf file (within the .odt):

<?xml version="1.0" encoding="utf-8"?>
<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
<rdf:Description rdf:about="content.xml#id1265690860">
<ns1:comment xmlns:ns1="http://www.w3.org/2000/01/rdf-schema#">; for
16-bit app support
[mci extensions]

The malicious XML entities could also include URLs to attacker-controlled
HTTP or FTP resources. This would allow an attacker to determine when a
document was opened, potentially resulting in reduced privacy. However, based
on current analysis of the affected office applications, the most serious attack
scenario is likely to be:

1. Attacker posts a malicious file on a web site or sends file to victim. The
file contains a form for the victim to fill out and return to the attacker.

2. Victim fills out the form, saves it, sends it back to the attacker.

3. Attacker is able to read the contents of any stolen files as embedded
metadata, simply by unzipping the returned file and reading the malicious RDF

This attack clearly requires some significant user interaction. However, other
applications which rely on librdf/libraptor have not been analyzed. It is
plausible that the context of the external entity interpretation in other
software could allow for more serious automated file retrieval attacks.

Versions Affected
The 1.x and 2.x major versions of librdf are affected.

Thus far, all recent versions of open source office products appear to be
affected, since these products rely on librdf/raptor for the interpretation of
RDF files. This, in turn relies on libxml2 which supports external entity
interpretation by default. OpenOffice and LibreOffice include a modified copy of
librdf 1.x which was vulnerable at the time of testing. It is likely that all
previously release 3.x versions of OpenOffice and LibreOffice are vulnerable.
AbiWord and KOffice rely on a copy of librdf which is installed by the
underlying operating system.

Numerous other open source software packages depend on librdf or libraptor
(including ardour, libslv2, lv2file, morla, soprano, and numerous
language-specific wrappers), but it is not known if these are exploitable in any
realistic scenario.

Vendor Response
The following timeline provides an overview of communication with the primary
affected vendors:

2012-01-09 OpenOffice, LibreOffice, AbiWord, KOffice, and libraptor
maintainers were provided a draft advisory and test sample.
The OpenWall "distros" mailing list was also notified.
Apache OpenOffice Security team acknowledged notification.
libraptor developer confirmed flaw.

2012-01-10 CVE-2012-0037 assigned by Apache.

2012-02-02 Notified OpenWall "distros" mailing list again, due to previous
technical problems.

2012-02-04 libraptor developer provided patches to all notified parties.

2012-02-22 Extensive arguing between vendors about embargo/release date.

2012-03-06 More arguing about release date.

2012-03-14 Agreed upon release date established.

2012-03-22 Security updates and vendor advisories released.

2012-03-24 VSR advisory released.

Users of most open source operating system distributions should update to the
latest librdf package as soon as possible, once a patched version is available
for their distribution. OpenOffice and LibreOffice packages should also be
upgraded, since these include a custom copy of the library.

Users of other operating systems who use LibreOffice or OpenOffice should
upgrade these packages to the latest release versions as soon as possible.

Developers of software which rely on librdf or libraptor should assess the risk
of XXE attacks on interpreted XML files and take appropriate actions to notify
their users based on how their software operates. VSR would be happy to assist
developers in these efforts on a case-by-case basis.

Common Vulnerabilities and Exposures (CVE) Information
The Common Vulnerabilities and Exposures (CVE) project has assigned
the number CVE-2012-0037 to this issue. This is a candidate for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.

Thanks to Leper for help in preliminary testing.

Thanks to Jan iankko Lieskovsky, Daniel Veillard, Caolán McNamara, and Michael
Stahl for performing deeper analysis on the interaction between libraptor and



1. http://librdf.org/raptor/

2. http://librdf.org/

3. http://www.w3.org/RDF/


This advisory is distributed for educational purposes only with the sincere
hope that it will help promote public safety. This advisory comes with
absolutely NO WARRANTY; not even the implied warranty of merchantability or
fitness for a particular purpose. Neither Virtual Security Research, LLC nor
the author accepts any liability for any direct, indirect, or consequential
loss or damage arising from use of, or reliance on, this information.

See the VSR disclosure policy for more information on our responsible
disclosure practices:

Copyright 2012 Virtual Security Research, LLC. All rights reserved.

Version: GnuPG v1.4.12 (GNU/Linux)


Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By