0day.today - Biggest Exploit Database in the World.
![](/img/logo_green.jpg)
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earnGOLD
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Milton Webdav 2.7.0.1 XXE Injection Vulnerability
Author
Risk
![](/img/risk/critlow_3.gif)
Security Risk High
]0day-ID
Category
Date add
CVE
Platform
I've recently found vulnerability in Milton Webdav 2.7.0.1 (project page - http://milton.io/). Milton Webdav is a Java library for adding webdav capabilities to your applications. Milton Webdav supports PROPFIND, PROPPATCH and LOCK methods. This Webdav methods expect XML in request body. Java classes io.milton.http.webdav.DefaultPropFindRequestFiledParser, io.milton.http.webdav.DefaultPropPatchParser and io.milton.http.LockInfoSaxHandler are responsible for parsing and processing incoming XML for PROPFIND, PROPPATCH and LOCK methods. To parse XML requests these classes use SAXParser from Xerces2-J library (http://xerces.apache.org/xerces2-j/) but failed to securely setup parameters for SAXParser. Here is the code snippet from io.milton.http.webdav.DefaultPropFindRequestFiledParser. .. @Override public PropertiesRequest getRequestedFields( InputStream in ) { final Set<QName> set = new LinkedHashSet<QName>(); try { ByteArrayOutputStream bout = new ByteArrayOutputStream(); StreamUtils.readTo( in, bout, false, true ); byte[] arr = bout.toByteArray(); if( arr.length > 1 ) { ByteArrayInputStream bin = new ByteArrayInputStream( arr ); XMLReader reader = XMLReaderFactory.createXMLReader(); reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false); .. This code prohibits declaration of external parameter entities. At the same time general external entities and external DTDs are allowed. Attacker can exploit this issue by adding DOCTYPE declaration to XML body of PROPFIND, PROPPATCH and LOCK methods that references external DTD or have general external entity declaration. Vulnerability allows attacker to read local files (list directory content), perform SSRF and DoS attacks. Exploit for CVE-2015-1833 written by me (https://www.exploit-db.com/exploits/37110/) with minor modifications could be used to exploit this issue. Now vulnerability is patched. See commits b5851c1 and b41072b here https://github.com/miltonio/milton2. If you use Milton Webdav 2.7.0.1 or below, please, update to version 2.7.0.3. # 0day.today [2024-07-05] #