PeopleSoft XML External Entity Remote File Disclosure Vulnerability
BID:6647
Info
PeopleSoft XML External Entity Remote File Disclosure Vulnerability
| Bugtraq ID: | 6647 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-1252 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 20 2003 12:00AM |
| Updated: | Jul 11 2009 07:17PM |
| Credit: | This vulnerability was announced in an ISS advisory. |
| Vulnerable: |
PeopleSoft PeopleTools 8.19 PeopleSoft PeopleTools 8.18 PeopleSoft PeopleTools 8.17 PeopleSoft PeopleTools 8.16 PeopleSoft PeopleTools 8.15 PeopleSoft PeopleTools 8.14 |
| Not Vulnerable: |
PeopleSoft PeopleTools 8.19 PeopleSoft PeopleTools 8.4 |
Discussion
PeopleSoft XML External Entity Remote File Disclosure Vulnerability
A vulnerability has been discovered in the PeopleSoft Application Messaging Gateway. The problem occurs in the Gateway Administration servlet and can be exploited to obtain the contents of an arbitrary file.
This issue occurs due to invalid sanitization of user-supplied XML data in certain POST requests to the Gateway Administration servlet. By including an XML external entity, it may be possible for an attacker to make the server disclose a files contents within the servers response.
Information obtained through the exploitation of this vulnerability may aid an attacker in launching further attacks against a target server. It has been reported that under certain circumstances it may be possible to open arbitrary TCP connections through the affected servlet.
A vulnerability has been discovered in the PeopleSoft Application Messaging Gateway. The problem occurs in the Gateway Administration servlet and can be exploited to obtain the contents of an arbitrary file.
This issue occurs due to invalid sanitization of user-supplied XML data in certain POST requests to the Gateway Administration servlet. By including an XML external entity, it may be possible for an attacker to make the server disclose a files contents within the servers response.
Information obtained through the exploitation of this vulnerability may aid an attacker in launching further attacks against a target server. It has been reported that under certain circumstances it may be possible to open arbitrary TCP connections through the affected servlet.
Exploit / POC
PeopleSoft XML External Entity Remote File Disclosure Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
PeopleSoft XML External Entity Remote File Disclosure Vulnerability
Solution:
PeopleSoft has announced the release date of PeopleTools 8.19 which addresses this issue. Futher information regarding this package can be obtained from the PeopleSoft website.
Solution:
PeopleSoft has announced the release date of PeopleTools 8.19 which addresses this issue. Futher information regarding this package can be obtained from the PeopleSoft website.
References
PeopleSoft XML External Entity Remote File Disclosure Vulnerability
References:
References: