OpenText Documentum Administrator / Webtop XXE Injection Vulnerability
| Reporter | Title | Published | Views | Family All 21 |
|---|---|---|---|---|
 | OpenText Documentum Administrator XML External Reference File Read DoS | 17 Oct 201700:00 | – | bdu_fstec |
| OpenText Documentum Webtop XML Link Restriction File Read DoS | 17 Oct 201700:00 | – | bdu_fstec |
 | OpenText Documentum Administrator XML External Entity Injection Vulnerability | 27 Sep 201700:00 | – | cnvd |
| OpenText Documentum Webtop XML External Entity Injection Vulnerability | 27 Sep 201700:00 | – | cnvd |
 | CVE-2017-14526 | 27 Sep 201717:00 | – | cve |
| CVE-2017-14527 | 27 Sep 201717:00 | – | cve |
 | CVE-2017-14526 | 27 Sep 201717:00 | – | cvelist |
| CVE-2017-14527 | 27 Sep 201717:00 | – | cvelist |
 | EUVD-2017-6027 | 7 Oct 202500:30 | – | euvd |
| EUVD-2017-6028 | 7 Oct 202500:30 | – | euvd |
10
Title: OpenText Documentum Administrator and Webtop - XML External
Entity Injection
Author: Jakub Palaczynski, Pawel Gocyla
Date: 24. September 2017
CVE (Administrator): CVE-2017-14526
CVE (Webtop): CVE-2017-14527
Affected software:
==================
Documentum Administrator
Documentum Webtop
Exploit was tested on:
======================
Documentum Administrator version 7.2.0180.0055
Documentum Webtop version 6.8.0160.0073
Other versions may also be vulnerable.
XML External Entity Injection - 4 instances:
============================================
Please note that examples below are for Documentum Administrator, but
the same exploitation takes place in Webtop.
This vulnerability allows for:
- listing directories and retrieving content of files from the filesystem
- stealing hashes of user that runs Documentum (if installed on Windows)
- DoS
1. Instance 1 and 2:
Authenticated users can exploit XXE vulnerability by browsing "Tools >
Preferences". It generates request to
/xda/com/documentum/ucf/server/transport/impl/GAIRConnector which
contains two XML structures. Both accept DTD and parse it which allows
exploitation.
2. Instance 3:
Authenticated users can exploit XXE vulnerability by using "File >
Import". Users can import XML files and use "MediaProfile" to open
file which triggers vulnerability.
3. Instance 4:
Authenticated users can exploit XXE vulnerability by using "File >
Check In". Users can use XML check in file and use "MediaProfile" to
open it which triggers vulnerability.
Fix:
====
https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
Contact:
========
Jakub[dot]Palaczynski[at]gmail[dot]com
pawellgocyla[at]gmail[dot]com
# 0day.today [2018-02-15] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
27 Sep 2017 00:00Current
9Critical risk
Vulners AI Score9
EPSS0.01376