The POC used to prove this vulnerability (POC 1 below) contained the following XML content: This is expected behaviour for SSDP/UPNP.īy hosting a specially crafted XML file at that location, we can force UMS to do several things. UMS will automatically access the Device Descriptor over HTTP, parsing the XML content. When we do this, we provide the location of an XML file containing more information about our device. We can reply to that UDP multicast directly on the same port that the request initiated from, informing this client that we have a shared device. This is the first step in finding and adding Universal Plug and Play (UPNP) devices. The discovery process is handled by Simple Service Discovery Protocol (SSDP), which sends a UDP multicast out to 239.255.255.250 on port 1900. UMS, like many other media servers, will attempt to discover other devices on a local network. UMS version affected: Tested on 7.1.0 (current as of July 2018). Operating Systems affected: Verified Windows 10 (likely all versions) Impact: Information disclosure up to code executionĪffected component: UMS's SSDP discovery / XML parsing UMS team responded to notification within an hour, patch in progress. Initiate SMB connections to relay NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.Įxploitation can be demonstrated using evil-ssdp ().

Initiate SMB connections to capture NetNTLM challenge/response and crack to clear-text password. Access arbitrary files from the filesystem with the same permission as the user account running UMS. Unauthenticated attackers on the same LAN can use this vulnerability to:

The XML parsing engine for Universal Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Issue: Out-of-Band XXE in Universal Media Server's SSDP Processing

Universal media server android client