PT-2014-3739 · Emc · Emc Cloud Tiering Appliance

Brandon Perry · Publicado 2014-04-17 · Atualizado 2014-04-17 · CVE-2014-0644

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions EMC Cloud Tiering Appliance (CTA) versions 10 through SP1

Description The issue allows remote attackers to read arbitrary files via an "api/login" request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This can be demonstrated by reading the /etc/shadow file.

Recommendations For versions 10 through SP1, as a temporary workaround, consider restricting access to the "api/login" endpoint until a patch is available. Avoid using XML external entity declarations in conjunction with entity references in the api/login request until the issue is resolved.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-0644

Produtos afetados

Emc Cloud Tiering Appliance

Referências · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/emc_cta_xxe.rb · Exploit
• 🔥 https://exploit-db.com/exploits/32623 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-0644 · Nota de Segurança
• http://seclists.org/fulldisclosure/2014/Mar/426 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html · Nota
• https://gist.github.com/brandonprry/9895721 · Nota