CVE-2018-13416

published 2018-08-03

CVE-2018-13416: In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack…

Priority P2 74 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running UMS, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
spirton	universal_media_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/initstring/evil-ssdp↗

port 1900↗

ip 239.255.255.250↗

ua UMS/7.1.0 Windows10/10.0 UPnP/1.0 Cling/2.0↗

path /ssdp/device-desc.xml↗

path /ssdp/data.dtd↗

port 445↗

• → Detect outbound HTTP GET requests to attacker-controlled /ssdp/device-desc.xml paths originating from UMS processes, indicating XXE Device Descriptor retrieval. ↗
• → Alert on HTTP requests with User-Agent 'UMS/7.1.0 Windows10/10.0 UPnP/1.0 Cling/2.0' fetching XML files from unexpected/non-local hosts, as this indicates active SSDP XXE exploitation. ↗
• → Monitor for outbound SMB (port 445) connections initiated by the UMS process (java.exe), which may indicate NetNTLM credential capture/relay via XXE-triggered SMB entity. ↗
• → Detect HTTP GET requests to /ssdp/data.dtd followed by exfiltration requests to /?exfiltrated= on the same attacker host, indicating successful out-of-band XXE file exfiltration. ↗
• → Inspect inbound SSDP UDP responses on port 1900 for XML payloads containing ENTITY declarations (DOCTYPE with ENTITY tags), which are the hallmark of the XXE attack vector against UMS. ↗
• → Look for Java process (User-Agent: Java/1.8.0_171) making HTTP requests to /ssdp/data.dtd, indicating the second-stage DTD retrieval in a two-stage OOB XXE exfiltration chain. ↗

• · File exfiltration via XXE is limited to single-line files with no whitespace; multi-line or whitespace-containing files cannot be reliably exfiltrated with this technique. ↗
• · The vulnerability was verified on Windows 10 but older UMS versions and other Windows versions are also likely affected. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-611