CVE-2014-5035 - Opendaylight Vulnerable to Local and Remote File Inclusion in the Netconf (TCP) Service

[Gregory Pickett <gpickett71 () yahoo com>]

Title
===================
Opendaylight Vulnerable to Local and Remote File Inclusion in the Netconf (TCP) Service

Summary
===================
Opendaylight (www.opendaylight.com) is vulnerable to Local and Remote File Inclusion in the Netconf (TCP) Service via 
an External Entity Injection (XXE).  Opendaylight’s netconf service, when receiving an XML-RPC message, will process 
any external entities referenced in that message, local or remote.  And will do so using its own running credentials 
which are root.  So by injecting a reference to a local file, you can extract any file you like from the running system 
including the shadow file which can be leveraged by an attacker to perform an offline password attack.

Affected Products
===================
Opendaylight 1.0 (Hydrogen) – Base, Virtualization, and Service Provider Editions

CVE
===================
CVE-2014-5035

Details
===================
“To Be Released Later”

Impact
===================
Information Disclosure.  Disclosure of hashed system credentials, which enables mounting of offline password attacks.  
Eventual disclosure of clear-text system credentials.

Credits
===================
Gregory Pickett (@shogun7273), Hellfire Security


---------- 

Gregory Pickett, CISSP, GCIA, GPEN