CVE-2018-13417
CRITICALVuze Bittorrent Client 5.7.6.0 - XML External Entity Injection via SSDP/UPnP XML Parser
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2018-13417. PoCs published by Chris Moberly.
AI-analyzed exploit summary This exploit demonstrates an Out-of-Band XXE vulnerability in Vuze Bittorrent Client's SSDP processing, allowing unauthenticated attackers on the same LAN to access arbitrary files, capture NetNTLM hashes, or achieve remote command execution via SMB relay attacks.
Description
In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running Vuze, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.
Exploits (1)
This exploit demonstrates an Out-of-Band XXE vulnerability in Vuze Bittorrent Client's SSDP processing, allowing unauthenticated attackers on the same LAN to access arbitrary files, capture NetNTLM hashes, or achieve remote command execution via SMB relay attacks.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H