CVE-2023-45612-PoC

CVE-2023-45612 PoC This repository contains a proof of concept PoC for CVE-2023-45612 which allowed XXE in the default configuration of ContentNegotiation in ktor. The PoC is split into 2 parts: server/, containing an example of a Ktor server using an affected version of Ktor, with an endpoint...

ktor-xxe-poc

CVE-2023-45612: JetBrains Ktor XXE Proof of Concept This repository contains a vulnerable Ktor server to demonstrate the XML External Entity XXE injection vulnerability identified in CVE-2023-45612. The vulnerability exists in Ktor versions before 2.3.5 when the ContentNegotiation plugin is used...

CVE-2023-45612-PoC

CVE-2023-45612 https://nvd.nist.gov/vuln/detail/CVE-2023-45612 Description of CVE In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE. The vulnerability was patched by @marychatte on Sep 29, 2023 https://github.com/ktorio/ktor/pull/3770...

ktor-cve-2023-45612-poc

Ktor XXE Vulnerability Proof-of-Concept CVE-2023-45612 Summary Impact: Arbitrary files access via a crafted XML DTD with an XXE reference. Root cause: Unsafe XML document parser. This repo contains a vulnerable Ktor 2.3.4 app configured to allow external entities so the XXE effect is visible...

CVE-2023-45612

In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE...

The vulnerability of the ContentNegotiation configuration of the JetBrains Ktor web application framework allows attackers to execute XXE attacks.

The vulnerability of the ContentNegotiation configuration in the JetBrains Ktor web application framework is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability allows a remote attacker to perform XXE attacks...

CVE-2023-45612

In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE...

Default configuration

In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE...

CVE-2023-45612

In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE...

CVE-2023-45612

CVE-2023-45612 affects JetBrains Ktor with the ContentNegotiation XML format enabled in versions before 2.3.5. The root cause is an insecure default XML configuration that allows external entity processing, enabling XXE. Exploitation can lead to file disclosure (e.g., reading server files) and SS...

CVE-2023-45612

In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE...

JetBrains Ktor Code Issue Vulnerability

JetBrains Ktor framework is a web application framework from the Czech company JetBrains. A code issue vulnerability exists in JetBrains Ktor versions prior to 2.3.5 that stems from an XML External Entity Injection XXE vulnerability in the default configuration of ContentNegotiation...