CVE-2018-15506

Vulnerability

BubbleUPnP version 0.9 update 30 contains an XML External Entity (XXE) vulnerability in the XML parsing engine used for SSDP/UPnP functionality. The parser fails to disable external entity processing, allowing remote attackers to supply malicious XML payloads. This affects the BubbleUPnP server component, which processes UPnP discovery and control messages. The exact vulnerable versions are 0.9 update 30 and possibly earlier releases; later updates (e.g., 0.9 update 50 [1]) include general fixes but do not explicitly mention an XXE patch.

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted SSDP or UPnP XML request to the BubbleUPnP server on the local network. No authentication or prior access is required. The attacker crafts an XML payload that references external entities, pointing to local files or an SMB share. The server's parser then processes the entity, potentially exfiltrating data via out-of-band channels (e.g., HTTP or SMB) or performing Server-Side Request Forgery (SSRF) to internal SMB servers.

Impact

Successful exploitation allows the attacker to: 1. Read arbitrary files from the server's filesystem with the permissions of the BubbleUPnP user account, leading to sensitive information disclosure (e.g., configuration files, passwords, or tokens). 2. Initiate SMB connections to a remote attacker-controlled server, capturing a NetNTLM challenge/response hash. This hash can be used offline to crack the user's cleartext password or relayed to gain Remote Command Execution (RCE) on Windows domain networks. 3. Further leverage the SMB relay for lateral movement or privilege escalation within a Windows domain environment.

Mitigation

As of the latest available changelog [1], BubbleUPnP Server version 0.9 update 50 (released January 2, 2025) does not explicitly list a fix for this XXE vulnerability. Users should review the changelog for any security-related changes and consider upgrading to the latest version. If no official patch is confirmed, workarounds include restricting network access to the BubbleUPnP server (e.g., firewall rules) or disabling UPnP/SSDP functionality if not required. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.