Milton Webdav 2.7.0.1 XXE Injection

2015.11.03
Risk: High
Local: No
Remote: Yes
CWE: CWE-20


CVSS Base Score: 6.4/10
Impact Subscore: 4.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: None

Dear all, I've recently found vulnerability in Milton Webdav 2.7.0.1 (project page - http://milton.io/). Milton Webdav is a Java library for adding webdav capabilities to your applications. Milton Webdav supports PROPFIND, PROPPATCH and LOCK methods. This Webdav methods expect XML in request body. Java classes io.milton.http.webdav.DefaultPropFindRequestFiledParser, io.milton.http.webdav.DefaultPropPatchParser and io.milton.http.LockInfoSaxHandler are responsible for parsing and processing incoming XML for PROPFIND, PROPPATCH and LOCK methods. To parse XML requests these classes use SAXParser from Xerces2-J library (http://xerces.apache.org/xerces2-j/) but failed to securely setup parameters for SAXParser. Here is the code snippet from io.milton.http.webdav.DefaultPropFindRequestFiledParser. .. @Override public PropertiesRequest getRequestedFields( InputStream in ) { final Set<QName> set = new LinkedHashSet<QName>(); try { ByteArrayOutputStream bout = new ByteArrayOutputStream(); StreamUtils.readTo( in, bout, false, true ); byte[] arr = bout.toByteArray(); if( arr.length > 1 ) { ByteArrayInputStream bin = new ByteArrayInputStream( arr ); XMLReader reader = XMLReaderFactory.createXMLReader(); reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false); .. This code prohibits declaration of external parameter entities. At the same time general external entities and external DTDs are allowed. Attacker can exploit this issue by adding DOCTYPE declaration to XML body of PROPFIND, PROPPATCH and LOCK methods that references external DTD or have general external entity declaration. Vulnerability allows attacker to read local files (list directory content), perform SSRF and DoS attacks. Exploit for CVE-2015-1833 written by me (https://www.exploit-db.com/exploits/37110/) with minor modifications could be used to exploit this issue. Now vulnerability is patched. See commits b5851c1 and b41072b here https://github.com/miltonio/milton2. If you use Milton Webdav 2.7.0.1 or below, please, update to version 2.7.0.3.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top