CVE-2023-4357-Chrome-XXE

Tool Introduction

• The world's first single file exploits the CVE-2023-4357 Chrome XXE vulnerability EXP, allowing attackers to obtain local files of visitors.
• The world's first single file exploits the CVE-2023-4357 Chrome XXE vulnerability EXP, allowing attackers to obtain local files of visitors.

File Name	Description	Exploit Scenario	Why can a single file / single payload achieve exploitation?
d.svg	Single file exploitation, no dependency on other files	1. When XSS is possible, embed the svg link in an iframe. 2. When a button is clicked, open the svg image in a new window.	Self-contained. The first entity declaration referencing an external entity is blocked, so we thought of self-including the file as an external XML document, then making a second entity declaration referencing the external entity, requiring the two reference formats to be compatible without errors, thereby bypassing the block and reading local files.
xss.html	Single payload exploitation, no dependency on other files	When XSS is possible and you don't want to upload an svg file on any website, copy the content of xss.html as the payload.	object element, data:image/svg+xml;base64, data:text/xsl;base64

Interesting Sharing

• This single-file EXP was used as the inspiration for problem design in the TPCTF 2023 Information Security Competition (jointly organized by TP-Link, Tsinghua University, and Peking University).
• Problems: Xssbot and Xssbot but not Internet
• Sharp-eyed contestants noticed my comment //You can send p.innerHTML by POST.: cn-sec, xmcve, jbnrz
• Contributing interesting learning resources for new information security enthusiasts is one of the meanings of this open source project.

Vulnerability Introduction

Information	Content
Vulnerability Name	Chromium XXE
CVE ID	CVE-2023-4357
Risk Level	High
Vulnerability Type	XXE
Exploit Difficulty	Low

Vulnerability Description

• The root cause of the vulnerability lies in libxslt. By default, Chromium strictly validates whether the external entity URL referenced by the entity declaration in an XML document is cross-origin. However, if Chromium first parses it as an XSL stylesheet and then uses document() to include an external XML document, Chromium does not perform cross-origin validation on the URL of this external XML document, causing local file disclosure for the visitor.

Affected Versions

• Chrome version < 116.0.5845.96
• Chromium version < 116.0.5845.96
• Electron version < 26.1.0
• WeChat for Mac version < 3.8.5.17

Reproduction Screenshots

Visitor Environment	Screenshot
Linux + Chromium
Windows + Chromium
MacOS + WeChat for Mac

Reproduction 1

1. Visitor Environment:

Linux + Chromium

2. Download and run Chrome

wget https://edgedl.me.gvt1.com/edgedl/chrome/chrome-for-testing/114.0.5735.90/linux64/chrome-linux64.zip
unzip chrome-linux64.zip
./chrome-linux64/chrome --no-sandbox

3. Start Web service

wget https://codeload.github.com/xcanwin/CVE-2023-4357-Chrome-XXE/zip/refs/heads/main -O CVE-2023-4357-Chrome-XXE.zip
unzip CVE-2023-4357-Chrome-XXE.zip
python3 -m http.server 8888 -d CVE-2023-4357-Chrome-XXE-main

4. Visit in browser

http://127.0.0.1:8888/d.svg

Reproduction 2

1. Visitor Environment:

Windows + Chromium

2. Download and run Chrome

https://edgedl.me.gvt1.com/edgedl/chrome/chrome-for-testing/114.0.5735.90/win64/chrome-win64.zip

./chrome-win64/chrome --no-sandbox

3. Start Web service

https://codeload.github.com/xcanwin/CVE-2023-4357-Chrome-XXE/zip/refs/heads/main

python3 -m http.server 8888 -d CVE-2023-4357-Chrome-XXE-main

4. Visit in browser

http://127.0.0.1:8888/d.svg

Reproduction 3

1. Visitor Environment:

MacOS + WeChat for Mac

2. Download and run WeChat for Mac

3. Start Web service

wget https://codeload.github.com/xcanwin/CVE-2023-4357-Chrome-XXE/zip/refs/heads/main -O CVE-2023-4357-Chrome-XXE.zip
unzip CVE-2023-4357-Chrome-XXE.zip
python3 -m http.server 8888 -d CVE-2023-4357-Chrome-XXE-main

4. Send to File Transfer Assistant and visit

http://127.0.0.1:8888/d.svg