Zend Framework XXE Injection

`Hello!  
  
I'll give you additional information concerning SEC Consult Vulnerability  
Lab Security Advisory 20120626-0 (http://securityvulns.ru/docs28331.html).  
  
This advisory was about Local file disclosure via XXE injection in Zend  
Framework and was talking only about Local File Disclosure attack vector. It  
was just mentioned in description that via this vulnerability it's also  
possibility to open arbitrary TCP connections. LFD attack vector is  
important and is has more risk, so it's clear why Daniel concentrated on it.  
But I think that other attack vector is also important, so will bring your   
attention to it.  
  
As I've wrote in my July's article "Using XML External Entities (XXE) for  
attacks on other sites", which I've announced last week in WASC Mailing List  
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2012-August/008481.html),  
XXE vulnerabilities could be used for attacks on other sites. Similarly as  
AoF vulnerabilities, about which I've wrote in my 2010's article "Using of  
the sites for attacks on other sites"  
(http://lists.grok.org.uk/pipermail/full-disclosure/2010-June/075384.html).  
In this article I've wrote about possibility of attacks on other sites via  
Abuse of Functionality and Remote File Include vulnerabilities, and showed  
examples of Abuse of Functionality holes at different web sites (including  
sites of Google, Yahoo and W3C). In similar way XXE vulnerabilities can be  
used for conducting CSRF and DoS attacks on other sites.  
  
XEE (WASC-43):  
  
For the attack it's needed to send the next XML data in POST request:  
  
<?xml version="1.0"?>  
<!DOCTYPE foo [  
<!ELEMENT methodName ANY>  
<!ENTITY xxe SYSTEM "http://site/page" >]>  
<methodCall>  
<methodName>&xxe;</methodName>  
</methodCall>  
  
It concerns as Zend Framework and different web applications, which are  
using Zend Framework (XXE holes in some of them were disclosed recently), as  
to those applications, holes in which were disclosed earlier. Like Adobe  
BlazeDS, Adobe LiveCycle Data Services ES2, Adobe ColdFusion, Adobe  
LiveCycle ES2 (http://securityvulns.ru/Xdocument288.html).  
  
So there are multiple web applications and thousands of web sites, which are  
vulnerable to these attacks (via Zend Framework and web applications based  
on it and via old versions of multiple Adobe's products). Not thousands of  
web applications (about AoF vulnerabilities in which I've wrote during  
2010-2011) and millions of web sites, but still a lot, and in total we have  
a lot of web sites, which can be used for attacks on other sites via  
different vulnerabilities (AoF, RFI, XXE). So web developers also should  
draw attention to this attack vector.  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua   
  
`