CVE-2013-3617
published 2013-11-02CVE-2013-3617: The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity…
PriorityP334low3.5CVSS 2.0
AVNACMAuSCPINAN
EXPLOIT
EPSS
21.07%
97.3th percentile
The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbravo | openbravo_erp | <= 3.0 | — |
| openbravo | openbravo_erp | — | — |
| openbravo | openbravo_erp | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor HTTP requests to the /ws/dal/ XML API endpoints (e.g., /ws/dal/ADUser) for POST bodies containing external entity declarations (DOCTYPE with SYSTEM or PUBLIC keywords), which are characteristic of XXE exploitation attempts. ↗
- →Alert on authenticated HTTP POST requests to Openbravo ERP /ws/dal/* endpoints where the request body contains XML with <!DOCTYPE and SYSTEM file:// or similar URI schemes, indicating local file read via XXE. ↗
- →The exploit payload uses an entity reference &xxe; within the XML body sent to the DAL API; inspect XML payloads for entity references resolving to local filesystem paths. ↗
- ·Exploitation requires valid (authenticated) credentials; unauthenticated access to the /ws/dal/ API is not sufficient to trigger the XXE vulnerability. ↗
- ·The Metasploit module was specifically tested against Openbravo ERP versions 3.0MP25 and 2.50MP6; coverage of other minor versions is not confirmed. ↗
- ·Files are read as the OS user running the Openbravo process, which is generally not root, limiting the scope of accessible files. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Openbravo ERP - XML External Entity Information Disclosure
exploitdb·2013-10-30
CVE-2013-3617 Openbravo ERP - XML External Entity Information Disclosure
Openbravo ERP - XML External Entity Information Disclosure
---
source: https://www.securityfocus.com/bid/63431/info
Openbravo ERP is prone to an information-disclosure vulnerability.
An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks.
Openbravo ERP 2.5 and 3.0 are vulnerable.
]>
C970393BDF6C43E2B030D23482D88EED
&xxe;
Metasploit
Openbravo ERP XXE Arbitrary File Read
metasploit
Openbravo ERP XXE Arbitrary File Read
Openbravo ERP XXE Arbitrary File Read
The Openbravo ERP XML API expands external entities which can be defined as local files. This allows the user to read any files from the FS as the user Openbravo is running as (generally not root). This module was tested against Openbravo ERP version 3.0MP25 and 2.50MP6.
No writeups or analysis indexed.
http://www.kb.cert.org/vuls/id/533894http://www.securityfocus.com/bid/63431https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treatshttp://www.kb.cert.org/vuls/id/533894http://www.securityfocus.com/bid/63431https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats
2013-11-02
Published