XML External Entity (XXE) vulnerability in the WSO2 Management Console
Hakan Bayır ( Biznet Bilişim ) <hakan.bayir-bwKeqTGMmZm/[email protected]> Mon, 6 Jun 2022 17:37:11 +0300
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <CAHkBGCEKwHwja1iAgHUbfWca2oBrykSSDwr_7DZB9mG_qzSF6w@mail.gmail.com> |
WE1MIEV4dGVybmFsIEVudGl0eSAoWFhFKSB2dWxuZXJhYmlsaXR5IGluIHRoZSBXU08yIE1hbmFn ZW1lbnQgQ29uc29sZQoKSS4gVlVMTkVSQUJJTElUWQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t ClhNTCBFeHRlcm5hbCBFbnRpdHkgKFhYRSkKCklJLiBDVkUgUkVGRVJFTkNFCi0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0KQ1ZFLTIwMjEtNDI2NDYKCklJSS4gVkVORE9SCi0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0KaHR0cHM6Ly93c28yLmNvbS8KCklWLiBUSU1FTElORQotLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tCjE0LzAyLzIwMjEgVnVsbmVyYWJpbGl0eSBkaXNjb3ZlcmVkCjE0LzAyLzIw MjEgVmVuZG9yIGNvbnRhY3RlZAowMS8wNy8yMDIxIFdTTzIgcmVwbGF5IHRoYXQgdGhleSBmaXhl ZAoKVi4gQ1JFRElUCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KSGFrYW4gQmF5aXIgYXQgQ3li ZXJ3aXNlLgoKVkkuIERFU0NSSVBUSU9OCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KQW4gWE1M IEV4dGVybmFsIEVudGl0eSB2dWxuZXJhYmlsaXR5IHdhcyBpZGVudGlmaWVkIGluIHRoZSBmaWxl IGJhc2VkCnNlcnZpY2UgcHJvdmlkZXIgY3JlYXRpb24gZmVhdHVyZSBvZiB0aGUgTWFuYWdlbWVu dCBDb25zb2xlLgoKaHR0cHM6Ly9kb2NzLndzbzIuY29tL2Rpc3BsYXkvU2VjdXJpdHkvU2VjdXJp dHkrQWR2aXNvcnkrV1NPMi0yMDIxLTEyODkKCgpWSUkuIFJlbWVkaWF0aW9uCi0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0KSWYgdGhlIGxhdGVzdCB2ZXJzaW9uIG9mIHRoZSBhZmZlY3RlZCBXU08y IHByb2R1Y3QgaXMgbm90IG1lbnRpb25lZCB1bmRlcgp0aGUgYWZmZWN0ZWQgcHJvZHVjdCBsaXN0 LCB5b3UgbWF5IG1pZ3JhdGUgdG8gdGhlIGxhdGVzdCB2ZXJzaW9uIHRvIHJlY2VpdmUKc2VjdXJp dHkgZml4ZXMuIE90aGVyd2lzZSB5b3UgbWF5IGFwcGx5IHRoZSByZWxldmFudCBmaXhlcyB0byB0 aGUgcHJvZHVjdApiYXNlZCBvbiB0aGUgcHVibGljIGZpeDoKaHR0cHM6Ly9naXRodWIuY29tL3dz bzIvY2FyYm9uLWlkZW50aXR5LWZyYW1ld29yay9wdWxsLzM0NzIKCi0tIApIYWthbiBCYXnEsXIK R8O8dmVubGlrIFRlc3RsZXJpIFV6bWFuxLEKTSA6ICs5MCA1MDYgNzI4IDcxIDQ3Cnd3dy5iaXpu ZXQuY29tLnRyCkJpem5ldCBCaWxpxZ9pbSBBLsWeLgrDnG5pdmVyc2l0ZWxlciBNYWguIMSwaHNh bgpEb8SfcmFtYWPEsSBCbHYuLgpUZWtub2tlbnQgxLBraXpsZXIgQmluYXPEsSBObzozNSBCIEJs b2sgS2F0OjEKMDY4MDAgT0RUw5wgfCBBTktBUkEKPGh0dHBzOi8vd3d3LmZhY2Vib29rLmNvbS9i aXpuZXRicy8+IDxodHRwczovL3R3aXR0ZXIuY29tL2Jpem5ldGJpbGlzaW0+CjxodHRwczovL3Ry LmxpbmtlZGluLmNvbS9jb21wYW55L2Jpem5ldC1iaWxpc2ltPgoKLS0gCgoKCgogICAgCiAgICAK CgoKQnUgbWVzYWogdmUgZWtsZXJpLCBtZXNhamRhIApnw7ZuZGVyaWxkacSfaSBiZWxpcnRpbGVu IApracWfaS9racWfaWxlcmUgw7Z6ZWxkaXIgdmUgZ2l6bGlkaXIuIEJ1IG1lc2FqIApoZXJoYW5n aSBiaXIgYW1hw6cgacOnaW4gCsOnb8SfYWx0xLFsYW1heiwgZGHEn8SxdMSxbGFtYXogdmUgeWF5 xLFubGFuYW1hei4gCk1lc2FqxLFuIGfDtm5kZXJpbGRpxJ9pIGtpxZ9pIApkZcSfaWxzZW5peiwg bWVzYWogacOnZXJpxJ9pbmkgeWEgZGEgZWtsZXJpbmkgCmtvcHlhbGFtYXnEsW7EsXosIHlhecSx bmxhbWF5xLFuxLF6IAp5YSBkYSBiYcWfa2Ega2nFn2lsZXJlIHnDtm5sZW5kaXJtZXlpbml6IHZl IAptZXNhasSxIGfDtm5kZXJlbiBracWfaXlpIGRlcmhhbCAKdXlhcmFyYWsgYnUgbWVzYWrEsSBz aWxpbml6LiDFnmlya2V0aW1peiwgCm1lc2FqxLFuIGnDp2VyacSfaW5pbiB2ZSBla2xlcmluaW4g CnNpemUgZGXEn2nFn2lrbGnEn2UgdcSfcmF5YXJhayB2ZXlhIGdlw6cgCnVsYcWfbWFzxLFuZGFu OyBnaXpsaWxpxJ9pbmluIAprb3J1bm1hbWFzxLFuZGFuOyB2aXLDvHMgacOnZXJtZXNpbmRlbiB2 ZSAKYmlsZ2lzYXlhciBzaXN0ZW1pbml6ZSB2ZXJlYmlsZWNlxJ9pIApoZXJoYW5naSBiaXIgemFy YXJkYW4gc29ydW1sdSAKZGXEn2lsZGlyCgoKVGhpcyBtZXNzYWdlIGFuZCBpdHMgCmF0dGFjaG1l bnRzIAphcmUgY29uZmlkZW50aWFsIGFuZCBpbnRlbmRlZCBzb2xlbHkgZm9yIHRoZSByZWNpcGll bnQocykgCnN0YXRlZCB0aGVyZWluLiAKVGhpcyBtZXNzYWdlIGNhbm5vdCBiZSBjb3BpZWQsIGRp c3RyaWJ1dGVkIG9yIHB1Ymxpc2hlZCAKZm9yIGFueSBwdXJwb3NlLiAKSWYgeW91IGFyZSBub3Qg dGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIGRvIG5vdCAKY29weSwgcHVibGlzaCBvciAK Zm9yd2FyZCB0aGUgaW5mb3JtYXRpb24gZXhpc3RpbmcgaW4gdGhlIGNvbnRlbnQgYW5kIAphdHRh Y2htZW50cyBvZiB0aGlzIAptZXNzYWdlLiBJbiBzdWNoIGNhc2UgcGxlYXNlIG5vdGlmeSB0aGUg c2VuZGVyIAppbW1lZGlhdGVseSBhbmQgZGVsZXRlIGFsbCAKdGhlIGNvcGllcyBvZiB0aGUgbWVz c2FnZS4gT3VyIGNvbXBhbnkgc2hhbGwgCmhhdmUgbm8gbGlhYmlsaXR5IGZvciBhbnkgCmNoYW5n ZXMgaW4gb3IgbGF0ZSByZWNlaXZpbmcgb2YgdGhlIG1lc3NhZ2UsIApsb3NzIG9mIGludGVncml0 eSBhbmQgCmNvbmZpZGVudGlhbGl0eSwgdmlydXNlcyBhbmQgYW55IGRhbWFnZXMgY2F1c2VkIGlu CiBhbnl3YXkgdG8geW91ciBjb21wdXRlciAKc3lzdGVtIGJhc2VkIG9uIHRoaXMgbWVzc2FnZS4K CipQIEzDvHRmZW4gZ2VyZWttaXlvcnNhIGJ1IHBvc3RhecSxIGJhc21hecSxbi4gClBsZWFzZSBj b25zaWRlciB0aGUgZW52aXJvbm1lbnQgLSBkbyB5b3UgcmVhbGx5IG5lZWQgdG8gcHJpbnQgdGhp cyBlbWFpbCA/KgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XwpTZW50IHRocm91Z2ggdGhlIEZ1bGwgRGlzY2xvc3VyZSBtYWlsaW5nIGxpc3QKaHR0cHM6Ly9u bWFwLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Z1bGxkaXNjbG9zdXJlCldlYiBBcmNoaXZlcyAmIFJT UzogaHR0cHM6Ly9zZWNsaXN0cy5vcmcvZnVsbGRpc2Nsb3N1cmUv