-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Title ===== SCHUTZWERK-SA-2023-006: Arbitrary File Read via XML External Entities in Visual Planning Status ====== PUBLISHED Version ======= 1.0 CVE reference ============= CVE-2023-49234 Link ==== https://www.schutzwerk.com/advisories/schutzwerk-sa-2023-006/ Text-only version: https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2023-006.txt Affected products/vendor ======================== All versions prior to Visual Planning 8 (Build 240207) by STILOG I.S.T. Summary ======= Authenticated attackers can exploit a weakness in the XML parser functionality of the Visual Planning[0] application in order to obtain read access to arbitrary files on the application server. Depending on configured access permissions, this vulnerability could be used by an attacker to exfiltrate secrets stored on the local file system. Risk ==== An attacker can use the vulnerability to gather information and depending on the stored data, exfiltrate secrets from the file system. Furthermore, HTTP requests can be used for out-of-bands exfiltration and possibly server side request forgery (SSRF) attacks. Description =========== During a recent red teaming assessment, Visual Planning was identified as part of the customers internet-facing assets. The software is developed by STILOG I.S.T. and provides resource management and scheduling features. A security assessment conducted by SCHUTZWERK found an arbitrary file read vulnerability via XML external entities in Visual Planning. The application Admin Center (vpadmin) communicates with the server through an XML-based protocol that utilizes proprietary compression methods and is transmitted via HTTP. SCHUTZWERK implemented a custom proxy as part of an assessment in order to intercept and manipulate the messages exchanged between application and server. One of the messages sent by the Admin Center application after authentication is the following: PWD false
INSTALLDATA
The method GetApplicationProperty is called to request the value of the property PWD. The server responds with an XML message, where the value element contains the response of the query: OK In this response it was observed that if the requested property value could not be resolved, the content of the request element defaultValue will be reflected as part of the response, making it a suitable back channel for XML external entity (XXE) injections. The following message was sent to the Visual Planning application: ]> &example; ShowBackground false
Application
The server responds with the content of the requested install.properties file inside the value element, thus confirming the XML parser is vulnerable to XML external entity (XXE) injections: OK # #Tue Oct 03 15:37:33 CEST 2023 INSTALLDATA.INSTALLSERIAL= INSTALLDATA.INSTALLURL=http\://127.0.0.1\:8080/vplanning INSTALLDATA.OK=Next INSTALLDATA.PAGE=PROVIDER INSTALLDATA.POOLMODE=1 INSTALLDATA.PORT=3306 INSTALLDATA.PROVIDERTYPE=MySQL INSTALLDATA.PWD=ENCODE\: INSTALLDATA.SERVER=127.0.0.1 INSTALLDATA.SERVERLANG=de INSTALLDATA.USER=root INSTALLDATA.VIEWERSERIAL= Further testing showed that out-of-bands exfiltration via HTTPS requests is also generally possible. Solution/Mitigation =================== The vendor suggests to update to Visual Planning 8 (Build 240207) Disclosure timeline =================== 2023-11-01: Vulnerability discovered 2023-11-09: Contact vendor in order to determine security contact 2023-11-10: Received generic sales response from vendor 2023-11-14: Contacted CTO of vendor directly 2023-11-16: Vulnerabilities demonstrated in call with contact at vendor 2023-11-24: CVE assigned by Mitre 2023-11-24: Additional technical details provided to vendor 2023-12-19: Vendor informed SCHUTZWERK that work on fixing the findings is in progress 2024-01-30: Inquired about mitigation status regarding the reported vulnerabilities 2024-01-30: Vendor informed SCHUTZWERK that some of the issues were already fixed 2024-03-08: Sent advisory drafts to vendor 2024-03-28: Received patch information and release of advisory Contact/Credits =============== The vulnerability was discovered during an assessment by Lennert Preuth and David Brown of SCHUTZWERK GmbH. References ========== [0] https://www.visual-planning.com/en/ Disclaimer ========== The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The most recent version of this security advisory can be found at SCHUTZWERK GmbH's website ( https://www.schutzwerk.com ). Additional information ====================== SCHUTZWERK Advisories: https://www.schutzwerk.com/blog/tags/advisories/ SCHUTZWERK Advisory Policy: https://www.schutzwerk.com/en/advisories/ -----BEGIN PGP SIGNATURE----- iQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmYF0bcaHGFkdmlzb3Jp ZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrsdwA/+MyfbZTe36+AYi9q6GJE6 S75Xm2aZtEM3NC5F6aMcELqFEW7LNjERmBoqfkHe+SWfgFxeCXl/XelHaNnR7HTM ZZPCGwJmOI+XaraInPVdCDw1QVIdiCG4VZzE0tlnFbLBgM+OTOxcDOoG7OhzP6mm ALfankzxu3AfbZhwebQtSXIQ+YqjitTsvjQGPleylqYK5CJbChsyvmMjomu/GzdO sWQ25ODCVUy6VORet8yn5OkQnM2CjSkteuTdNxCzd6JUB+vQ0g5FCE5NVzkqYq21 YJ4Fc3PgkyAnrGefSbueL+Z/K6btM8RysJAwGahIEOdlkG8W/p09L0QQUGERT2VN UO6oTi/1OyoJBV9L5umr6aHss3P92ln90UAUW2dlZOdGSB8rlXisxLC1wtFZAXH9 YwiGY/ACXmV1FtQQpgFxfNRyEWaltU5S0Y0bPAaW+ABSMLlK4X0Ft9E/4s4Yel2d TGngEnVKcR/PKNtrJbBqPDwt98R0MdQi0QxBRaxGxAg4Yr1qex8ph6IRT7bDTm0/ 1CKlQL7y9uvXlnFE4CO3IkKNp0ejKn3A7QEep4jit07VItIc+sRsoMnB6v54DoML ZfIisDoijb3doTNieyMpgTGZTDWLwLO36IS9JiqafNCAnngExqylFX6vYQVggtRz mZ2yA2/9ZfQwOawEirQtQr8= =TUGM -----END PGP SIGNATURE-----