0dd - The Zero (0) Day Division

ZoneMinder PHP Objection Injection

Sun, 28 Oct 2018 00:00:00 +0000

The Issue

PHP Object Deserialization Injection attacks utilise the unserialize function within PHP. The deserialisation of the PHP object can trigger certain methods within the object, allowing the attacker to perform unauthorised actions like execution of code, disclosure of information, etc.

The ZoneMinder project overly trusted user input when processing the data obtained from a form.

Where the Issue Occurred

Displayed below is the code within the ZoneMinder project containing the vulnerable code (line 176 zoneminder/web/skins/classic/views/monitor.php#L176):

$probe = unserialize(base64_decode($_REQUEST['probe'])); 

Disclosure Timeline

Issue Reported: 24th October 2018
Blog Post Published: 28th October 2018
Applied for CVE:

ZoneMinder PHP Objection Injection (2)

Sun, 28 Oct 2018 00:00:00 +0000

The Issue

The ZoneMinder project overly trusted user input when processing the data obtained from a form.

Where the Issue Occurred

Displayed below is the code within the ZoneMinder project containing the vulnerable code (line 216 zoneminder/web/skins/classic/views/onvifprobe.php#L216):

$probe = unserialize(base64_decode($_REQUEST['probe']));

Disclosure Timeline

Issue Reported: 24th October 2018
Blog Post Published: 28th October 2018
Applied for CVE:

XR3Player XXE

Sun, 28 Oct 2018 00:00:00 +0000

The Issue

An XML External Entity attack is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.

XR3Player insecurely parses user-supplied XML content within the ParsePlaylist.java file, allowing attackers to perform XXE attacks.

Where the Issue Occurred

Found on line 42 XR3Player/releases/futurecode/rubbishCode/ParsePlaylist.java#L42:

parser.parse(url.toString(), contentType, is, playlist);

Found on line 92 JavaPlaylistParser/src/wseemann/media/jplaylistparser/parser/AutoDetectParser.java#L92:

parser.parse(uri, stream, playlist);

Found on line 136 JavaPlaylistParser/src/wseemann/media/jplaylistparser/parser/asx/ASXPlaylistParser.java#L136:

doc = builder.build(in);

Disclosure Timeline

Issue Reported: 24th October 2018
Blog Post Published: 28th October 2018
Applied for CVE:

UML Designer XXE

Sun, 28 Oct 2018 00:00:00 +0000

The Issue

UML Designer insecurely parses user-supplied XML content within the ProfileDiagramServices.java file, allowing attackers to perform XXE attacks.

Where the Issue Occurred

Found on line 163 - 173 UML-Designer/plugins/org.obeonetwork.dsl.uml2.design/src/org/obeonetwork/dsl/uml2/design/api/services/ProfileDiagramServices.java#L163-173:

final DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = null;
try {
	builder = builderFactory.newDocumentBuilder();
} catch (final ParserConfigurationException e) {
	LogServices.INSTANCE.error(exceptionMsg, e);
}
org.w3c.dom.Document document = null;
try {
	if (builder != null) {
		document = builder.parse(pluginXML.getLocation().toFile());

Disclosure Timeline

Issue Reported: 24th October 2018
Blog Post Published: 28th October 2018
Applied for CVE:

UBilling PHP Objection Injection

Sun, 28 Oct 2018 00:00:00 +0000

The Issue

The UBilling project overly trusted user input when processing the data obtained from a form.

Where the Issue Occurred

Displayed below is the code within the UBilling project containing the vulnerable code (Ubilling/modules/general/userreg/index.php#L64):

$newuser_data = unserialize(base64_decode($_POST['repostdata']));

Disclosure Timeline

Issue Reported: 29th September 2018
Blog Post Published: 28th October 2018
Applied for CVE:

RunElite XXE

Sun, 28 Oct 2018 00:00:00 +0000

The Issue

RunElite insecurely parses user-supplied XML content within the OSRSNewsServer.java file, allowing attackers to perform XXE attacks.

Where the Issue Occurred

The code below retrieves the XML content and performs insecure XML parsing (found on line 72 - 74 runelite/http-service/src/main/java/net/runelite/http/service/feed/osrsnews/OSRSNewsService.java#L72-74):

Document document = DocumentBuilderFactory.newInstance() 
	.newDocumentBuilder() 
	.parse(in);

The URL below can be intercepted (found on line 53 runelite/http-service/src/main/java/net/runelite/http/service/feed/osrsnews/OSRSNewsService.java#L53):

private static final HttpUrl RSS_URL = HttpUrl.parse("http://services.runescape.com/m=news/latest_news.rss?oldschool=true");

Disclosure Timeline

Issue Reported: 24th October 2018
Blog Post Published: 28th October 2018
Applied for CVE:

Microweber XSS

Sun, 28 Oct 2018 00:00:00 +0000

The Issue

Reflected Cross-Site Scripting (XSS) may allow an attacker to execute JavaScript code in the context of the victim’s browser. This may lead to unauthorised actions being performed, unauthorised access to data, stealing of session information, denial of service, etc. An attacker needs to coerce a user into visiting a link with the XSS payload to be properly exploited against a victim.

Where the Issue Occurred

Line 114 microweber/userfiles/modules/users/login/templates/admin.php#L114:

<input class="mw-ui-field mw-ui-field-big silver-field" autofocus="" tabindex="1" required name="username" type="text" placeholder="<?php _e("Username or Email"); ?>" <?php if (isset($_REQUEST['username']) != false): ?> value="<?php print $_REQUEST['username'] ?>"  <?php endif;

Disclosure Timeline

Issue Reported: 29th September 2018
Blog Post Published: 28th October 2018
Applied for CVE:

MegaMek Java Objection Injection

Sun, 28 Oct 2018 00:00:00 +0000

The Issue

The deserialisation of the Java object can trigger certain methods within the object, allowing the attacker to perform unauthorised actions like execution of code, disclosure of information, etc.

The MegaMek project overly trusted user input when processing the data obtained from a form.

Where the Issue Occurred

Displayed below is the code within the MegaMek project containing the vulnerable code (found on line 67 megamek/megamek/src/megamek/common/net/ObjectStreamConnection.java#67):

packet = (NetworkPacket) in.readObject();

Disclosure Timeline

Issue Reported: 29th September2018
Blog Post Published: 28th October 2018

K9Mail XXE

Sun, 28 Oct 2018 00:00:00 +0000

The Issue

K9Mail insecurely parses user-supplied XML content within the WebDavStore.java file, allowing attackers to perform XXE attacks. An attacker can potentially control a malicious WebDAV server or intercept the reponse of a valid WebDAV server to perform this attack.

Where the Issue Occurred

The code below retrieves the XML content and performs insecure XML parsing (found on line 943 k-9/mail/protocols/webdav/src/main/java/com/fsck/k9/mail/store/webdav/WebDavStore.java#L943):

xr.parse(new InputSource(istream));

Disclosure Timeline

Issue Reported: 24th October 2018
Blog Post Published: 28th October 2018
Applied for CVE:

HAPI FHIR XXE

Sun, 28 Oct 2018 00:00:00 +0000

The Issue

HAPI FHIR insecurely parses user-supplied XML content within the XLSXmlParser.java file, allowing attackers to perform XXE attacks.

Where the Issue Occurred

Found on line 165 - 168 hapi-fhir/hapi-fhir-utilities/src/main/java/org/hl7/fhir/utilities/XLSXmlParser.java#L165-168:

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setNamespaceAware(true);
DocumentBuilder builder = factory.newDocumentBuilder();
return builder.parse(in);

Disclosure Timeline

Issue Reported: 24th October 2018
Blog Post Published: 28th October 2018
Applied for CVE: