CVE-2018-12463 PoC — MFSBGN03811 rev.1 - Fortify Software Security Center (SSC), Multiple vulnerabilities

Source

https://github.com/alt3kx/CVE-2018-12463

Associated Vulnerability

Title: MFSBGN03811 rev.1 - Fortify Software Security Center (SSC), Multiple vulnerabilities (CVE-2018-12463)
Description:An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.

Description

XML external entity (XXE) vulnerability in /ssc/fm-ws/services in Fortify Software Security Center (SSC) 17.10, 17.20 & 18.10  (0day CVE-2018-12463)

Readme

# CVE-2018-12463
XML external entity (XXE) vulnerability in /ssc/fm-ws/services in Fortify Software Security Center (SSC) 17.10, 17.20 & 18.10 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request..

Exploit-DB publication at https://www.exploit-db.com/exploits/45027/ </br>
PacketStorm publication at https://packetstormsecurity.com/files/148539/Fortify-SSC-17.10-17.20-18.10-XXE-Injection.html

# Timeline
================</br>
2018-05-24: Discovered</br>
2018-05-25: Retest PRO environment</br>
2018-05-31: Vendor notification, two issues found</br> 
2018-05-31: Vendor feedback received</br>
2018-06-01: Internal communication</br>
2018-06-01: Vendor feedback, two issues are confirmed</br>
2018-06-05: Vendor notification, new issue found</br>
2018-06-06: Vendor feedback, evaluating High submission</br>
2018-06-08: Vendor feedback, High issue is confirmed</br>
2018-06-19: Researcher, reminder sent</br>
2018-06-22: Vendor feedback, summary of CVEs handled as official way</br>
2018-06-26: Vendor feedback, official Hotfix for High issue available to test</br>
2018-06-29: Researcher feedback</br>
2018-07-02: Researcher feedback</br>
2018-07-04: Researcher feedback, Hotfix tested on QA environment</br>
2018-07-05: Vendor feedback</br>
2018-07-09: Vendor feedback, final details to disclosure the CVE and official Hotfix availabe for customers</br>
2018-07-09: Vendor feedback, CVE and official Hotfix to be disclosure</br>
2018-07-12: Agreements with the vendor to publish the CVE/Advisory. </br>
2018-07-12: Public report</br>

# Microfocus (Fortify Product) Patch and credits: 
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03201563

![vendor_patch_credits_12 jul 18](https://user-images.githubusercontent.com/3140111/42652203-f2c4630e-8611-11e8-85c2-319f18bb84d7.png)

# Author
Alex Hernandez aka <em><a href="https://twitter.com/_alt3kx_" rel="nofollow">(@\_alt3kx\_)</a></em><br>
My current exploit list @exploit-db: https://www.exploit-db.com/author/?a=1074 <br>
CVE-2018-12463 with sexy screens here: https://medium.com/@alt3kx

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →