[ERPSCAN-17-020] XXE VIA DOCTYPE in PeopleSoft PeopleSoftServiceListeningConnector

ERPScan inc <[email protected]> Thu, 20 Apr 2017 18:25:15 +0300
Newsgroups gmane.comp.security.fulldisclosure,gmane.comp.security.penetration,gmane.comp.security.news.securitytracker,gmane.comp.security.bugtraq
Message-ID <CANHWe92er7bYYovSNyu3HZMqc-5r-8y9_m1w3U_1WecjgiGNFA@mail.gmail.com>
QXBwbGljYXRpb246IE9yYWNsZSBQZW9wbGVTb2Z0ClZlcnNpb25zIEFmZmVjdGVkOiBQZW9wbGVT
b2Z0IEhDTSA5LjIgb24gUGVvcGxlVG9vbHMgOC41NQpWZW5kb3IgVVJMOiBodHRwOi8vb3JhY2xl
LmNvbQpCdWc6IFhYRQpSZXBvcnRlZDogMjMuMTIuMjAxNgpWZW5kb3IgcmVzcG9uc2U6IDI0LjEy
LjIwMTYKRGF0ZSBvZiBQdWJsaWMgQWR2aXNvcnk6IDE4LjA0LjIwMTcKUmVmZXJlbmNlOiBPcmFj
bGUgQ1BVIEFwcmlsIDIwMTcKQXV0aG9yOiBOYWR5YSBLcml2ZHl1ayAoRVJQU2NhbikKCgpEZXNj
cmlwdGlvbgoKMS4gQURWSVNPUlkgSU5GT1JNQVRJT04KVGl0bGU6W0VSUFNDQU4tMTctMDIwXSBY
WEUgVklBIERPQ1RZUEUgaW4gUGVvcGxlU29mdApQZW9wbGVTb2Z0U2VydmljZUxpc3RlbmluZ0Nv
bm5lY3RvcgpBZHZpc29yeSBJRDogW0VSUFNDQU4tMTctMDIwXQpSaXNrOiBoaWdoCkNWRTogQ1ZF
LTIwMTctMzU0OApBZHZpc29yeSBVUkw6IGh0dHBzOi8vZXJwc2Nhbi5jb20vYWR2aXNvcmllcy9l
cnBzY2FuLTE3LTAyMC14eGUtdmlhLWRvY3R5cGUtcGVvcGxlc29mdC8KRGF0ZSBwdWJsaXNoZWQ6
IDE4LjA0LjIwMTcKVmVuZG9ycyBjb250YWN0ZWQ6IE9yYWNsZQoKCjIuIFZVTE5FUkFCSUxJVFkg
SU5GT1JNQVRJT04KCkNsYXNzOiBYWEUKSW1wYWN0OiBGaWxlIGRpc2Nsb3N1cmUsIG5ldHdvcmsg
ZGlzY292ZXJ5ClJlbW90ZWx5IEV4cGxvaXRhYmxlOiB5ZXMKTG9jYWxseSBFeHBsb2l0YWJsZTog
bm8KCkNWU1MgSW5mb3JtYXRpb24KQ1ZTUyBCYXNlIFNjb3JlIHYzOiAgICA4LjAgLyAxMApDVlNT
IEJhc2UgVmVjdG9yOgpBViA6IEF0dGFjayBWZWN0b3IgKFJlbGF0ZWQgZXhwbG9pdCByYW5nZSkg
TmV0d29yayAoTikKQUMgOiBBdHRhY2sgQ29tcGxleGl0eSAoUmVxdWlyZWQgYXR0YWNrIGNvbXBs
ZXhpdHkpIEhpZ2ggKEgpClBSIDogUHJpdmlsZWdlcyBSZXF1aXJlZCAoTGV2ZWwgb2YgcHJpdmls
ZWdlcyBuZWVkZWQgdG8gZXhwbG9pdCkgSGlnaCAoSCkKVUkgOiBVc2VyIEludGVyYWN0aW9uIChS
ZXF1aXJlZCB1c2VyIHBhcnRpY2lwYXRpb24pIE5vbmUgKE4pClMgOiBTY29wZSAoQ2hhbmdlIGlu
IHNjb3BlIGR1ZSB0byBpbXBhY3QgY2F1c2VkIHRvIGNvbXBvbmVudHMgYmV5b25kCnRoZSB2dWxu
ZXJhYmxlIGNvbXBvbmVudCkgQ2hhbmdlZCAoQykKQyA6IEltcGFjdCB0byBDb25maWRlbnRpYWxp
dHkgSGlnaCAoSCkKSSA6IEltcGFjdCB0byBJbnRlZ3JpdHkgSGlnaCAoSCkKQSA6IEltcGFjdCB0
byBBdmFpbGFiaWxpdHkgSGlnaCAoSCkKCjMuIFZVTE5FUkFCSUxJVFkgREVTQ1JJUFRJT04KCkEg
bWFsaWNpb3VzIHVzZXIgY2FuIG1vZGlmeSBhbiBYTUwtYmFzZWQgcmVxdWVzdCB0byBpbmNsdWRl
IFhNTApjb250ZW50IHRoYXQgaXMgdGhlbiBwYXJzZWQgbG9jYWxseS4KCjQuIFZVTE5FUkFCTEUg
UEFDS0FHRVMKClBlb3BsZVNvZnQgSENNIDkuMiBvbiBQZW9wbGVUb29scyA4LjU1Cgo1LiBTT0xV
VElPTlMgQU5EIFdPUktBUk9VTkRTCgpUbyBjb3JyZWN0IHRoaXMgdnVsbmVyYWJpbGl0eSwgaW1w
bGVtZW50IE9yYWNsZSBDUFUgQXByaWwgMjAxNwoKNi4gQVVUSE9SCgpOYWR5YSBLcml2ZHl1awoK
CjcuIFRFQ0hOSUNBTCBERVNDUklQVElPTgoKQW4gYXR0YWNrZXIgY2FuIHVzZSBhbiBYTUwgZXh0
ZXJuYWwgZW50aXR5IHZ1bG5lcmFiaWxpdHkgdG8gc2VuZApzcGVjaWFsbHkgY3JhZnRlZCB1bmF1
dGhvcml6ZWQgWE1MIHJlcXVlc3RzLCB3aGljaCB3aWxsIGJlIHByb2Nlc3NlZApieSB0aGUgWE1M
IHBhcnNlci4gVGhlIGF0dGFja2VyIGNhbiB1c2UgYW4gWE1MIGV4dGVybmFsIGVudGl0eQp2dWxu
ZXJhYmlsaXR5IGZvciBnZXR0aW5nIHVuYXV0aG9yaXNlZCBhY2Nlc3MgdG8gdGhlIE9TIGZpbGUg
c3lzdGVtLgoKUG9DCgoKUE9TVCAvUFNJR1cvUGVvcGxlU29mdFNlcnZpY2VMaXN0ZW5pbmdDb25u
ZWN0b3IgSFRUUC8xLjEKSG9zdDogMTcyLjE2LjIuOTE6ODAwMApDb250ZW50LXR5cGU6IHRleHQv
eG1sCjwhRE9DVFlQRSBhIFBVQkxJQyAiLS8vQi9BL0VOIiAiQzpcd2luZG93cyI+Cgo4LiBBQk9V
VCBFUlBTY2FuIFJlc2VhcmNoCgpFUlBTY2FuIHJlc2VhcmNoIHRlYW0gc3BlY2lhbGl6ZXMgaW4g
dnVsbmVyYWJpbGl0eSByZXNlYXJjaCBhbmQKYW5hbHlzaXMgb2YgY3JpdGljYWwgZW50ZXJwcmlz
ZSBhcHBsaWNhdGlvbnMuIEl0IHdhcyBhY2tub3dsZWRnZWQKbXVsdGlwbGUgdGltZXMgYnkgdGhl
IGxhcmdlc3Qgc29mdHdhcmUgdmVuZG9ycyBsaWtlIFNBUCwgT3JhY2xlLApNaWNyb3NvZnQsIElC
TSwgVk13YXJlLCBIUCBmb3IgZGlzY292ZXJpbmcgbW9yZSB0aGFuIDQwMAp2dWxuZXJhYmlsaXRp
ZXMgaW4gdGhlaXIgc29sdXRpb25zICgyMDAgb2YgdGhlbSBqdXN0IGluIFNBUCEpLgoKRVJQU2Nh
biByZXNlYXJjaGVycyBhcmUgcHJvdWQgb2YgZGlzY292ZXJpbmcgbmV3IHR5cGVzIG9mCnZ1bG5l
cmFiaWxpdGllcyAoVE9QIDEwIFdlYiBIYWNraW5nIFRlY2huaXF1ZXMgMjAxMikgYW5kIG9mIHRo
ZSAiVGhlCkJlc3QgU2VydmVyLVNpZGUgQnVnIiBub21pbmF0aW9uIGF0IEJsYWNrSGF0IDIwMTMu
CgpFUlBTY2FuIGV4cGVydHMgcGFydGljaXBhdGVkIGFzIHNwZWFrZXJzLCBwcmVzZW50ZXJzLCBh
bmQgdHJhaW5lcnMgYXQKNjArIHByaW1lIGludGVybmF0aW9uYWwgc2VjdXJpdHkgY29uZmVyZW5j
ZXMgaW4gMjUrIGNvdW50cmllcyBhY3Jvc3MKdGhlIGNvbnRpbmVudHMgKCBlLmcuIEJsYWNrSGF0
LCBSU0EsIEhJVEIpIGFuZCBjb25kdWN0ZWQgcHJpdmF0ZQp0cmFpbmluZ3MgZm9yIHNldmVyYWwg
Rm9ydHVuZSAyMDAwIGNvbXBhbmllcy4KCkVSUFNjYW4gcmVzZWFyY2hlcnMgY2Fycnkgb3V0IHRo
ZSBFQVMtU0VDIHByb2plY3QgdGhhdCBpcyBmb2N1c2VkIG9uCmVudGVycHJpc2UgYXBwbGljYXRp
b24gc2VjdXJpdHkgYXdhcmVuZXNzIGJ5IGlzc3VpbmcgYW5udWFsIFNBUApzZWN1cml0eSByZXNl
YXJjaGVzLgoKRVJQU2NhbiBleHBlcnRzIHdlcmUgaW50ZXJ2aWV3ZWQgaW4gc3BlY2lhbGl6ZWQg
aW5mby1zZWMgcmVzb3VyY2VzIGFuZApmZWF0dXJlZCBpbiBtYWpvciBtZWRpYSB3b3JsZHdpZGUu
IEFtb25nIHRoZW0gdGhlcmUgYXJlIFJldXRlcnMsCllhaG9vLCBTQyBNYWdhemluZSwgVGhlIFJl
Z2lzdGVyLCBDSU8sIFBDIFdvcmxkLCBEYXJrUmVhZGluZywgSGVpc2UsCkNoaW5hYnl0ZSwgZXRj
LgoKT3VyIHRlYW0gY29uc2lzdHMgb2YgaGlnaGx5LXF1YWxpZmllZCByZXNlYXJjaGVycywgc3Bl
Y2lhbGl6ZWQgaW4KdmFyaW91cyBmaWVsZHMgb2YgY3liZXJzZWN1cml0eSAoZnJvbSB3ZWIgYXBw
bGljYXRpb24gdG8gSUNTL1NDQURBCnN5c3RlbXMpLCBnYXRoZXJpbmcgdGhlaXIgZXhwZXJpZW5j
ZSB0byBjb25kdWN0IHRoZSBiZXN0IFNBUCBzZWN1cml0eQpyZXNlYXJjaC4KCjkuIEFCT1VUIEVS
UFNjYW4KCkVSUFNjYW4gaXMgdGhlIG1vc3QgcmVzcGVjdGVkIGFuZCBjcmVkaWJsZSBCdXNpbmVz
cyBBcHBsaWNhdGlvbgpDeWJlcnNlY3VyaXR5IHByb3ZpZGVyLiBGb3VuZGVkIGluIDIwMTAsIHRo
ZSBjb21wYW55IG9wZXJhdGVzIGdsb2JhbGx5CmFuZCBlbmFibGVzIGxhcmdlIE9pbCBhbmQgR2Fz
LCBGaW5hbmNpYWwsIFJldGFpbCBhbmQgb3RoZXIKb3JnYW5pemF0aW9ucyB0byBzZWN1cmUgdGhl
aXIgbWlzc2lvbi1jcml0aWNhbCBwcm9jZXNzZXMuIE5hbWVkIGFzIGFuCuKAmEVtZXJnaW5nIFZl
bmRvcuKAmSBpbiBTZWN1cml0eSBieSBDUk4sIGxpc3RlZCBhbW9uZyDigJxUT1AgMTAwIFNBUApT
b2x1dGlvbiBwcm92aWRlcnPigJ0gYW5kIGRpc3Rpbmd1aXNoZWQgYnkgMzArIG90aGVyIGF3YXJk
cywgRVJQU2NhbiBpcwp0aGUgbGVhZGluZyBTQVAgU0UgcGFydG5lciBpbiBkaXNjb3ZlcmluZyBh
bmQgcmVzb2x2aW5nIHNlY3VyaXR5CnZ1bG5lcmFiaWxpdGllcy4gRVJQU2NhbiBjb25zdWx0YW50
cyB3b3JrIHdpdGggU0FQIFNFIGluIFdhbGxkb3JmIHRvCmFzc2lzdCBpbiBpbXByb3ZpbmcgdGhl
IHNlY3VyaXR5IG9mIHRoZWlyIGxhdGVzdCBzb2x1dGlvbnMuCgpFUlBTY2Fu4oCZcyBwcmltYXJ5
IG1pc3Npb24gaXMgdG8gY2xvc2UgdGhlIGdhcCBiZXR3ZWVuIHRlY2huaWNhbCBhbmQKYnVzaW5l
c3Mgc2VjdXJpdHksIGFuZCBwcm92aWRlIHNvbHV0aW9ucyBmb3IgQ0lTTydzIHRvIGV2YWx1YXRl
IGFuZApzZWN1cmUgU0FQIGFuZCBPcmFjbGUgRVJQIHN5c3RlbXMgYW5kIGJ1c2luZXNzLWNyaXRp
Y2FsIGFwcGxpY2F0aW9ucwpmcm9tIGJvdGggY3liZXJhdHRhY2tzIGFuZCBpbnRlcm5hbCBmcmF1
ZC4gQXMgYSBydWxlLCBvdXIgY2xpZW50cyBhcmUKbGFyZ2UgZW50ZXJwcmlzZXMsIEZvcnR1bmUg
MjAwMCBjb21wYW5pZXMgYW5kIE1TUHMsIHdob3NlIHJlcXVpcmVtZW50cwphcmUgdG8gYWN0aXZl
bHkgbW9uaXRvciBhbmQgbWFuYWdlIHNlY3VyaXR5IG9mIHZhc3QgU0FQIGFuZCBPcmFjbGUKbGFu
ZHNjYXBlcyBvbiBhIGdsb2JhbCBzY2FsZS4KCldlIOKAmGZvbGxvdyB0aGUgc3Vu4oCZIGFuZCBo
YXZlIHR3byBodWJzLCBsb2NhdGVkIGluIFBhbG8gQWx0byBhbmQKQW1zdGVyZGFtLCB0byBwcm92
aWRlIHRocmVhdCBpbnRlbGxpZ2VuY2Ugc2VydmljZXMsIGNvbnRpbnVvdXMgc3VwcG9ydAphbmQg
dG8gb3BlcmF0ZSBsb2NhbCBvZmZpY2VzIGFuZCBwYXJ0bmVyIG5ldHdvcmsgc3Bhbm5pbmcgMjAr
CmNvdW50cmllcyBhcm91bmQgdGhlIGdsb2JlLgoKCgoKQWRkcmVzcyBVU0E6IDIyOCBIYW1pbHRv
biBBdmVudWUsIEZsLiAzLCBQYWxvIEFsdG8sIENBLiA5NDMwMQoKUGhvbmU6IDY1MC43OTguNTI1
NQoKVHdpdHRlcjogQGVycHNjYW4KClNjb29wLWl0OiBCdXNpbmVzcyBBcHBsaWNhdGlvbiBTZWN1
cml0eQoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KU2Vu
dCB0aHJvdWdoIHRoZSBGdWxsIERpc2Nsb3N1cmUgbWFpbGluZyBsaXN0Cmh0dHBzOi8vbm1hcC5v
cmcvbWFpbG1hbi9saXN0aW5mby9mdWxsZGlzY2xvc3VyZQpXZWIgQXJjaGl2ZXMgJiBSU1M6IGh0
dHA6Ly9zZWNsaXN0cy5vcmcvZnVsbGRpc2Nsb3N1cmUv