Watchguard Firebox up to 11.12.1 XML-RPC Agent XML-RPC Request xml external entity reference

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Watchguard Firebox up to 11.12.1. This affects an unknown part of the component XML-RPC Agent. This manipulation as part of XML-RPC Request causes xml external entity reference. This vulnerability is registered as CVE-2017-8056. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Watchguard Firebox up to 11.12.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component XML-RPC Agent. The manipulation as part of a XML-RPC Request leads to a xml external entity reference vulnerability. The CWE definition for the vulnerability is CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. As an impact it is known to affect availability. The summary by CVE is:

WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. This causes the Firebox wgagent process to crash. This process crash ends all authenticated sessions to the Firebox, including management connections, and prevents new authenticated sessions until the process has recovered. The Firebox may also experience an overall degradation in performance while the wgagent process recovers. An attacker could continuously send XML-RPC requests that contain references to external entities to perform a limited Denial of Service (DoS) attack against an affected Firebox.

The bug was discovered 04/14/2017. The weakness was published 04/22/2017 (Website). The advisory is shared at watchguardsupport.force.com. This vulnerability is known as CVE-2017-8056 since 04/22/2017. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 8 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at VDB-100464. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Watchguard

Name

• Firebox

Version

• 11.12.0
• 11.12.1

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion