CVE-2011-3600
published 2019-11-26CVE-2011-3600: The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable…
PriorityP180high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
15.91%
96.5th percentile
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | ofbiz | — | — |
| apache | ofbiz | 16.11.01 – 16.11.04 | — |
| ofbiz | ofbiz | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Send a POST request to /webtools/control/xmlrpc with Content-Type: application/xml containing a DOCTYPE declaration with an external entity referencing /etc/passwd (or similar). A vulnerable server will return the file contents in the response body alongside a 'faultString' element. ↗
- →Match response body for both 'root:.*:0:0:' (successful /etc/passwd disclosure) AND 'faultString' to confirm exploitation of the XXE endpoint. ↗
- →Shodan/FOFA fingerprinting: identify exposed OFBiz instances via HTML body containing 'ofbiz' or the cookie name 'ofbiz.visitor=' to scope targets for CVE-2011-3600 testing. ↗
- →The vulnerability requires error messages from the XML parser to be reflected in the HTTP response; if the application suppresses parser error output, exploitation for information disclosure is not possible. ↗
- ·Affected versions are OFBiz 16.11.01 through 16.11.04 only; the vulnerability was fixed in 16.11.05 (SVN revisions 1833724, 1833708, 1836141). ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vulncheck7.5HIGH
vendor_apache7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
XML-RPC SAX parser information exposure
vendor_redhat·2010-02-06·CVSS 7.5
CVE-2011-3600 [HIGH] XML-RPC SAX parser information exposure
XML-RPC SAX parser information exposure
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: xmlrpc3 (Red Hat Enterprise Linux 6) - Will not fix
Apache
Apache ofbiz: CVE-2011-3600
vendor_apache·CVSS 7.5
CVE-2011-3600 [HIGH] Apache ofbiz: CVE-2011-3600
Apache ofbiz: CVE-2011-3600
; affected releases: from 16.11.01 to 16.11.04; fixed in 16.11.05 with revisions 1833724 , 1833708 , 1836141 .
GHSA
GHSA-88hg-2f8p-pv3w: The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with exec
ghsa_unreviewed·2022-04-22
CVE-2011-3600 [HIGH] CWE-611 GHSA-88hg-2f8p-pv3w: The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with exec
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
OSV
CVE-2011-3600: The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with exec
osv·2019-11-26·CVSS 7.5
CVE-2011-3600 [HIGH] CVE-2011-3600: The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with exec
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
VulnCheck
Apache OFBiz Improper Restriction of XML External Entity Reference
vulncheck·2011·CVSS 7.5
CVE-2011-3600 [HIGH] Apache OFBiz Improper Restriction of XML External Entity Reference
Apache OFBiz Improper Restriction of XML External Entity Reference
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
Affected: Apache OFBiz
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-21&host_type=src&vulnerability=cve-2
No detection rules found.
Nuclei
Apache OFBiz - XML External Entity Injection
nuclei·CVSS 7.5
CVE-2011-3600 [HIGH] Apache OFBiz - XML External Entity Injection
Apache OFBiz - XML External Entity Injection
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
Template:
id: CVE-2011-3600
info:
name: Apache OFBiz - XML External Entity Injection
author: daffainfo,pikpikcu
severity: high
description: |
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in
Bugzilla
CVE-2011-3600 XML-RPC SAX parser information exposure [fedora-14]
bugzilla·2011-10-08·CVSS 7.5
CVE-2011-3600 [HIGH] CVE-2011-3600 XML-RPC SAX parser information exposure [fedora-14]
CVE-2011-3600 XML-RPC SAX parser information exposure [fedora-14]
fedora-14 tracking bug for xmlrpc3: see blocks bug list for full details of the security issue(s).
This bug is never intended to be made public, please put any public notes
in the 'blocks' bugs.
[bug automatically created by: add-tracking-bugs]
Discussion:
Patch applied to f14 and build started.
---
xmlrpc3-3.0-6.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/xmlrpc3-3.0-6.fc14
---
Package xmlrpc3-3.0-6.fc14:
* should fix your issue,
* was pushed to the Fedora 14 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing xmlrpc3-3.0-6.fc14'
as soon as you are able to.
Please go to the f
Bugzilla
CVE-2011-3600 XML-RPC SAX parser information exposure
bugzilla·2011-05-18·CVSS 7.5
CVE-2011-3600 [HIGH] CVE-2011-3600 XML-RPC SAX parser information exposure
CVE-2011-3600 XML-RPC SAX parser information exposure
The changelog for XML-RPC 3.1.3 [1] indicates:
Fixed a potential security hole: The client has been able to include server side resources into the request by using external entities. Thanks to Johan Hôgre.
I have been unable to find where the fix is (no JIRA noted so cannot find a commit), so it is unclear whether this affects 3.0 or if this was introduced in 3.1.x at some point.
[1] http://ws.apache.org/xmlrpc/changes-report.html#a3.1.3
Discussion:
Do you know if there's a test or a way for us to determine if this is present in 3.0, Vincent? Thanks.
---
Andrew, I don't. I've been unable to find any information on this issue beyond the above (was notified of its existence by a Gentoo bug). I wish I could find the JIRA and a patc
http://mail-archives.apache.org/mod_mbox/ofbiz-user/201810.mbox/%3Cfad45546-af86-0293-9ea7-014553474b30%40apache.org%3Ehttps://access.redhat.com/security/cve/cve-2011-3600https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3600https://lists.apache.org/thread.html/7793319ae80ec350f7b82a8763460944f120ebe447f14a12155d0550%40%3Ccommits.ofbiz.apache.org%3Ehttps://security-tracker.debian.org/tracker/CVE-2011-3600http://mail-archives.apache.org/mod_mbox/ofbiz-user/201810.mbox/%3Cfad45546-af86-0293-9ea7-014553474b30%40apache.org%3Ehttps://access.redhat.com/security/cve/cve-2011-3600https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3600https://lists.apache.org/thread.html/7793319ae80ec350f7b82a8763460944f120ebe447f14a12155d0550%40%3Ccommits.ofbiz.apache.org%3Ehttps://security-tracker.debian.org/tracker/CVE-2011-3600
2019-11-26
Published
Exploited in the wild