CVE-2018-12463

XML external entity (XXE) vulnerability in /ssc/fm-ws/services in Fortify Software Security Center (SSC) 17.10, 17.20 & 18.10 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request..

Exploit-DB publication at https://www.exploit-db.com/exploits/45027/
PacketStorm publication at https://packetstormsecurity.com/files/148539/Fortify-SSC-17.10-17.20-18.10-XXE-Injection.html

Timeline

================
2018-05-24: Discovered
2018-05-25: Retest PRO environment
2018-05-31: Vendor notification, two issues found
2018-05-31: Vendor feedback received
2018-06-01: Internal communication
2018-06-01: Vendor feedback, two issues are confirmed
2018-06-05: Vendor notification, new issue found
2018-06-06: Vendor feedback, evaluating High submission
2018-06-08: Vendor feedback, High issue is confirmed
2018-06-19: Researcher, reminder sent
2018-06-22: Vendor feedback, summary of CVEs handled as official way
2018-06-26: Vendor feedback, official Hotfix for High issue available to test
2018-06-29: Researcher feedback
2018-07-02: Researcher feedback
2018-07-04: Researcher feedback, Hotfix tested on QA environment
2018-07-05: Vendor feedback
2018-07-09: Vendor feedback, final details to disclosure the CVE and official Hotfix availabe for customers
2018-07-09: Vendor feedback, CVE and official Hotfix to be disclosure
2018-07-12: Agreements with the vendor to publish the CVE/Advisory.
2018-07-12: Public report

Microfocus (Fortify Product) Patch and credits:

https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03201563

Author

Alex Hernandez aka (@_alt3kx_)
My current exploit list @exploit-db: https://www.exploit-db.com/author/?a=1074
CVE-2018-12463 with sexy screens here: https://medium.com/@alt3kx