Title: KYOCERA Multi-Set Template Editor 3.4 Out-Of-Band XML External Entity Injection
Advisory ID: ZSL-2018-5459
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information, DoS
Risk: (4/5)
Release Date: 07.04.2018

Summary

KYOCERA Net Admin is Kyocera's unified device management software that uses a web-based platform to give network administrators easy and uncomplicated control to handle a fleet for up to 10,000 devices. Tasks that used to require multiple programs or walking to each printer can now be accomplished in a single, fast and modern environment.

Description

KYOCERA Multi-Set Template Editor (part of Net Admin) suffers from an unauthenticated XML External Entity (XXE) injection vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data from the affected node via out-of-band (OOB) channel attack. The vulnerability is triggered when input passed to the Multi-Set Template Editor (kmmted.exe) called by the ActiveX DLL MultisetTemplateEditorActiveXComponent.dll is not sanitized while parsing a 5.x Multi-Set template XML file.

Vendor

KYOCERA Corporation - https://global.kyocera.com

Affected Version

3.4.0906

Tested On

Microsoft Windows 7 Professional SP1 (EN)
Apache Tomcat/8.5.15

Vendor Status

[28.03.2018] Vulnerability discovered.
[28.03.2018] Vendor contacted.
[06.04.2018] No response from the vendor.
[07.04.2018] Public security advisory released.

PoC

kyocera_xxe.txt

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] https://www.exploit-db.com/exploits/44430/
[2] https://exchange.xforce.ibmcloud.com/vulnerabilities/141385
[3] https://cxsecurity.com/issue/WLB-2018040069
[4] https://packetstormsecurity.com/files/147104

Changelog

[07.04.2018] - Initial release
[16.04.2018] - Added reference [1], [2], [3] and [4]

Contact

Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk