full-disclosure - [FD] Exploiting XXE vulnerabilities in AMF libraries

Open Source and information security mailing list archives

Message-ID: <1452517694.32222.479.camel@banzai2>
Date: Mon, 11 Jan 2016 14:08:14 +0100
From: Nicolas Grégoire <nicolas.gregoire@...rri.fr>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>, 
 bugtraq@...urityfocus.com
Subject: [FD] Exploiting XXE vulnerabilities in AMF libraries

Hello,

AMF (aka "Action Message Format") is a binary format used by Flash
applications communicating with server-side components. A few data types
supported by AMF deal with XML content (for example the "XML Document"
type in AMF0).

In 2015, several AMF libraries (including BlazeDS and PyAMF) were
identified as vulnerable to XXE (aka "XML External Entity") and SSRF
(aka "Server Side Forgery") attacks. I wrote a blog-post detailing:
- server-side exploitation of the PyAMF vulnerability
- server-side exploitation of the BlazeDS vulnerability
- client-side exploitation of the BlazeDS vulnerability

The article also includes a basic AMF client (in Python) used to exploit
these vulnerabilities (or interact with AMF gateways at large).

Link:
http://www.agarri.fr/kom/archives/2015/12/17/amf_parsing_and_xxe/index.html

Cheers,
Nicolas Grégoire

Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives