Add LabKey CVEs

CVE-2019-9757/README.md

@@ -0,0 +1,18 @@
+# CVE-2019-9757: LabKey Server XXE
+
+## Information
+**Description:** An XXE vulnerability exists in LabKey Server due to an outdated Java library. This allows arbitrary files to be read from the server.  
+**Versions Affected:** LabKey Server 19.1.0  
+**Researcher:** David Yesland (https://twitter.com/daveysec)  
+**Disclosure Link:** https://rhinosecuritylabs.com/application-security/labkey-server-vulnerabilities-to-rce  
+**NIST CVE Link:** https://nvd.nist.gov/vuln/detail/CVE-2019-9757  
+
+## Proof-of-Concept Exploit
+### Description
+The application parses SVG/XML data to render as an image if an external entity is used in the XML it is possible to render the contents of files into the image.  
+
+### Usage/Exploitation
+Within LabKey Server, export a report graph as a PNG and send the contents of CVE-2019-9757.svg with the POST request.  
+
+### Screenshot
+![Alt-text that shows up on hover](poc_image.png)

CVE-2019-9758/README.md

@@ -0,0 +1,18 @@
+# CVE-2019-9758: LabKey Server Stored XSS
+
+## Information
+**Description:** This allows Cross-Site Scripting to execute against an admin of LabKey Server which can lead to RCE.  
+**Versions Affected:** LabKey Server 19.1.0  
+**Researcher:** David Yesland (https://twitter.com/daveysec)  
+**Disclosure Link:** https://rhinosecuritylabs.com/application-security/labkey-server-vulnerabilities-to-rce  
+**NIST CVE Link:** https://nvd.nist.gov/vuln/detail/CVE-2019-9758  
+
+## Proof-of-Concept Exploit
+### Description
+The username is not sanitized in some portions of the application within the admin portal. This allows XSS payloads to be executed on an admin of the application which can also lead to XSS by abusing intended functionality of the application.  
+
+### Usage/Exploitation
+Set the username of a user to `<svg onload=alert(document.cookie)>` then attempt to clone the permissions of that user as an admin.  
+
+### Screenshot
+![Alt-text that shows up on hover](poc_image.gif)

CVE-2019-9926/CVE-2019-9926.html

@@ -0,0 +1 @@
+<img src='http://localhost:8080/labkey/reports-viewScriptReport.view?reportType=ReportService.rReport&script=system("ls")'>

CVE-2019-9926/README.md

@@ -0,0 +1,18 @@
+# CVE-2019-9926: LabKey Server CSRF
+
+## Information
+**Description:** This allows a CSRF attack to be performed against an admin of LabKey Server to an endpoint which can run R script and leads to RCE.  
+**Versions Affected:** LabKey Server 19.1.0  
+**Researcher:** David Yesland (https://twitter.com/daveysec)  
+**Disclosure Link:** https://rhinosecuritylabs.com/application-security/labkey-server-vulnerabilities-to-rce  
+**NIST CVE Link:** https://nvd.nist.gov/vuln/detail/CVE-2019-9926  
+
+## Proof-of-Concept Exploit
+### Description
+The application has functionality to process data using user defined scripts. This endpoint was found to be vulnerable to CSRF by changing a POST request to a GET. This allows an arbitrary script to be defined and executed if an authenticated admin visits the crafted URL.  
+
+### Usage/Exploitation
+As an authenticated admin visit `http://localhost:8080/labkey/reports-viewScriptReport.view?reportType=ReportService.rreport&script=system("ls")`.   
+
+### Screenshot
+![Alt-text that shows up on hover](poc_image.gif)

README.md

@@ -1,8 +1,10 @@
 # Rhino CVE Proof-of-Concept Exploits
 A collection of proof-of-concept exploit scripts written by the team at Rhino Security Labs for various CVEs.
 
-* [CVE‑2019‑16864: CompleteFTP Server Authenticated Remote Command Execution](CVE‑2019‑16864/)
 * [CVE-2019-16116: CompleteFTP Server Local Privilege Escalation](CVE-2019-16116/)
+* [CVE-2019-9926: LabKey Server CSRF](CVE-2019-9926/)
+* [CVE-2019-9758: LabKey Server Stored XSS](CVE-2019-9758/)
+* [CVE-2019-9757: LabKey Server XXE](CVE-2019-9757/)
 * [CVE-2019-5678: Command Injection in Nvidia GeForce Experience Web Helper](CVE-2019-5678/)
 * [CVE-2019-5674: Arbitrary File Overwrite in Nvidia GeForce Experience](CVE‑2019‑5674/)
 * [CVE-2019-0227: Apache Axis Remote Code Execution](CVE-2019-0227/)