CVE-2020-11991 PoC — StreamGenerator 代码问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11991.yaml

Associated Vulnerability

Title:StreamGenerator 代码问题漏洞 (CVE-2020-11991)
Description:StreamGenerator存在安全漏洞，攻击者可利用该漏洞访问服务器系统上的任何文件。

Description

Apache Cocoon 2.1.12 is susceptible to  XML injection. When using the StreamGenerator, the code parses a user-provided XML. A specially crafted XML, including external system entities, can be used to access any file on the server system.

File Snapshot


 id: CVE-2020-11991

info:
  name: Apache Cocoon 2.1.12 - XML Injection
  author: pikpikcu
  severity

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.