Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-45612-PoC — Proof-of-concept demonstrating XXE vulnerability in JetBrains Ktor < 2.3.5 via XML ContentNegotiation, with prevention guidelines and OWASP-based analysis. | Kitploit
Tools/GitHubGitHub/infernosalex/cve-2023-45612-poc
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityCTFLearning & Education
GitHubinfernosalex/cve-2023-45612-poc

CVE-2023-45612-PoC

Proof-of-concept demonstrating XXE vulnerability in JetBrains Ktor < 2.3.5 via XML ContentNegotiation, with prevention guidelines and OWASP-based analysis.

View Repository
1211 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2023-45612

  • https://nvd.nist.gov/vuln/detail/CVE-2023-45612

Description of CVE

In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE.

The vulnerability was patched by @marychatte on Sep 29, 2023 (https://github.com/ktorio/ktor/pull/3770), the vulnerability was caused by a supply chain attack based on a misconfiguration in the external library xmlutil version 0.86.1. vulnerability_xmlutil_diff

Based on the OWASP guide (https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser) , the fix is not comprehensive enough, I found a interesting answear here (https://security.stackexchange.com/questions/260956/java-xxe-vulnerability) : The main objective is to disable DTDs, it basically consists of the primary defense against this attack.

OWASP_Cheatsheet_XXE

What is OWASP?

  • OWASP (Open Worldwide Application Security Project) is a global, nonprofit community focused on improving software security. It provides free, vendor-neutral resources such as documentation, tools, and training to help developers, security researchers, and organizations build secure applications. One of its most known projects is the OWASP Top 10, which highlights the most critical web application security risks.

Proof of Concept

Proof_of_Concept-script

Prevention Guidelines

  • Upgrade: Ktor ≥ 2.3.5 and xmlutil to patched versions
  • Harden XML parsing:
    • Disable DOCTYPE declarations
    • Disable external general/parameter entities
    • Disable external DTD loading
    • Enable FEATURE_SECURE_PROCESSING
    • Disable XInclude
  • Prefer JSON over XML unless strictly required
  • Principle of least privilege: Run services without filesystem/network access for parsing
  • Input validation: Reject payloads with DOCTYPE declarations at application layer

References:

  • https://security.stackexchange.com/questions/260956/java-xxe-vulnerability
  • https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
  • https://docs.datadoghq.com/security/code_security/static_analysis/static_analysis_rules/java-security/xml-parsing-xee/
  • https://github.com/jwenjian/ghiblog/issues/37
  • https://www.jetbrains.com/privacy-security/issues-fixed/?product=Ktor
  • https://patorjk.com/software/taag/#p=display&f=Big&t=CVE-2023-45612%0A&x=none&v=4&h=4&w=80&we=false
  • https://github.com/ktorio/ktor/blob/05f8f73b8e20962fe55c003eb0757113e3495272/ktor-shared/ktor-serialization/ktor-serialization-kotlinx/ktor-serialization-kotlinx-xml/jvm/test/XmlServerKotlinxSerializationTest.kt
Download Tool