XXE-attacks-via-file-upload
XXE attacks via file upload​
Some applications allow users to upload files which are then processed server-side. Some common file formats use XML or contain XML subcomponents. Examples of XML-based formats are office document formats like DOCX and image formats like SVG.
For example, an application might allow users to upload images, and process or validate these on the server after they are uploaded. Even if the application expects to receive a format like PNG or JPEG, the image processing library that is being used might support SVG images. Since the SVG format uses XML, an attacker can submit a malicious SVG image and so reach hidden attack surface for XXE vulnerabilities.
Challenge​
This lab lets users attach avatars to comments and uses the Apache Batik library to process avatar image files. To solve the lab, upload an image that displays the contents of the
/etc/hostname
file after processing. Then use the "Submit solution" button to submit the value of the server hostname.
--> So i googled for Apache Batik Svg XXE
and i found one blog which describes it in detail. You can find it here
So i just made one svg file and added this payload in it:
<?xml version="1.0" standalone="yes"?><!DOCTYPE ernw [ <!ENTITY xxe SYSTEM "file:///etc/hostname" > ]><svg width="800px" height="200px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1"><text font-family="Verdana" font-size="60" x="10" y="40">&xxe;</text></svg>
Save this file as exploit.svg
--> I have changed width
,height
and font-size
because the output was not visible correctly.
So now goto any blog post and post comment and add exploit.svg
as avatar image.
After that goto source code and click image link and you will see the output of /etc/hostname
in image!
And we solved the lab!