CVE-2017-10617
MEDIUMJuniper Contrail 2.2-2.21.3, 3.0-3.0.3.3, 3.1-3.1.3.9, 3.2-3.2.4.9 - XML External Entity Injection via ifmap Service
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2017-10617. PoCs published by gteissier.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2017-10617, an XXE vulnerability in Juniper Contrail's IFMAP service (irond). The PoC demonstrates file disclosure by leveraging XML External Entity injection to read local files, including sensitive credentials.
Description
The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).
Exploits (1)
This repository contains a functional exploit for CVE-2017-10617, an XXE vulnerability in Juniper Contrail's IFMAP service (irond). The PoC demonstrates file disclosure by leveraging XML External Entity injection to read local files, including sensitive credentials.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N