[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] XXE Injection in NetIQ Access
From:       "MustLive" <mustlive () websecurity ! com ! ua>
Date:       2015-06-29 20:51:09
Message-ID: 006b01d0b2ad$6bdd5ca0$9b7a6fd5 () pc
[Download RAW message or body]

Hello list!

I'll give you additional information concerning advisory Multiple high risk 
vulnerabilities in NetIQ Access Manager 
(http://securityvulns.ru/docs31510.html). There are five different 
vulnerabilities in the advisory. For my attack it's needed to use only one 
vulnerability, XML External Entities Injection (XXE), to conduct attacks on 
other web sites from target host.

-------------------------
Affected products:
-------------------------

NetIQ Access Manager version 4.0 SP1 and previous versions.

-------------------------
Affected vendors:
-------------------------

Novell.

----------
Details:
----------

NetIQ Access Manager is vulnerable to XXE Injection.

Besides standard vectors of attacks with XXE Injection vulnerabilities (such 
as local file inclusion), which are usually mentioned in advisories, XXE 
Injection also allows to conduct attacks on other sites. And with using 
DAVOSET (DDoS attacks via other sites execution tool) it's possible to 
automate such attacks.

XML External Entities (XXE) (WASC-43):

https://site:8443/nps/servlet/webacc?taskId=fw.PreviewObjectFilter&nextState=initialState&merge= \
fw.TCPreviewFilter&query=<!DOCTYPE+request+[%0a<!ENTITY+xxe+SYSTEM+"http://target">%0a]><query><container>%26xxe%3b</container><subclasses>false</subclasses></query>


I wrote about such attacks in my 2012's article "Using XML External Entities 
(XXE) for attacks on other sites" 
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2012-August/008481.html) 
and 2013's "Using XXE vulnerabilities for attacks on other sites" 
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2013-August/008887.html). \
 As I described in my articles, XXE vulnerabilities can be used for 
conducting CSRF and DoS attacks on other sites (and at using multiple web 
sites it's possible to conduct DDoS attacks). And my tool DAVOSET can be 
used for conducting such attacks via XXE vulnerabilities.

Video demonstration of DAVOSET: http://www.youtube.com/watch?v=RKi35-f346I

So all vulnerable versions of NetIQ Access Manager can be used for attacks 
on other sites via XXE Injection.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/


[prev in list] [next in list] [prev in thread] [next in thread]