{"id":7034,"date":"2017-03-19T14:19:48","date_gmt":"2017-03-19T22:19:48","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/03\/19\/news-825\/"},"modified":"2017-03-19T14:19:48","modified_gmt":"2017-03-19T22:19:48","slug":"news-825","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/03\/19\/news-825\/","title":{"rendered":"SSD Advisory \u2013 Oracle Knowledge Management XXE Leading to a RCE"},"content":{"rendered":"

Credit to Author: Maor Schwartz| Date: Sun, 19 Mar 2017 08:05:05 +0000<\/strong><\/p>\n

\n

Vulnerability Summary<\/strong>
The following advisory describe Information Disclosure found in Oracle Knowledge Management version 8.5.1.<\/p>\n

By enabling searches across a wide variety of sources, Oracle’s InQuira knowledge management products offer simple and convenient ways for users to access knowledge that was once hidden in the myriad systems, applications, and databases used to store enterprise content.<\/p>\n

Oracle’s products for knowledge management help users find useful knowledge contained in corporate information stores.<\/p>\n

Credit<\/strong>
An independent security researcher, Steven Seeley, has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program.<\/p>\n

Vendor response<\/strong>
Oracle has released patches to address this vulnerability, for more details see: http:\/\/www.oracle.com\/technetwork\/security-advisory\/cpujul2016-2881720.html<\/a>.<\/p>\n

<\/span><\/p>\n

Vulnerability Details<\/strong>
The vulnerable code can be found in \/imws\/Result.jsp<\/em> which when calls, can be used to access an XML from a third-party server, this third-party server which can be under our control can be used to reference files locally present on the victim’s server.<\/p>\n

Proof of Concept<\/strong><\/p>\n

To exploit the vulnerability, we will run the following 5 steps (the first 2 need to be run in the background):<\/p>\n

    \n
  1. ‘Malicious’ XML External Entity (XXE) server<\/li>\n
  2. Listener for the gopher protocol<\/li>\n
  3. Attacker who steal the ‘custom.xml’ file<\/li>\n
  4. Decrypt\/crack the encrypted AES password<\/li>\n
  5. Shell on the machine<\/li>\n<\/ol>\n

    This image illustrates the steps this attack requires and the sequence of events that happen (behind the scenes):
    \"\"<\/a><\/p>\n

    Step 1 – setup a ‘malicious’ XML External Entity (XXE) server:<\/p>\n<\/p>\n

    \t\t<\/p>\n

    \n
    <\/span> \t\t\t<\/p>\n
    \n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n
    <\/div>\n