.. / CVE-2022-2414

Exploit for FreeIPA - XML Entity Injection (CVE-2022-2414)

Description:

Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.

Nuclei Template

View the template here CVE-2022-2414.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-2414.yaml
Copy

References:

https://nvd.nist.gov/vuln/detail/CVE-2022-2414
https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/webapp/Dogtag/Dogtag%20PKI%20XML%E5%AE%9E%E4%BD%93%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%20CVE-2022-2414.md
https://github.com/dogtagpki/pki/pull/4021