JAVA漏洞验证_微信XXE漏洞验证

漏洞修复方案参考:

测试方案：

对回调地址发送数据包:sample PUBLIC \"...\" \"http://locahost:99\">wx746bdd55xxx5ee4e124102780290000021bo872unudppfl1nngm5xxxgdjo3cq45n301DF1E7ABDD914XXX804CF102E7992IT测试数据-15307666138701127.0.0.12018070512571020180705155710134725512854375821

后台会爆,链接被拒绝,这表示XXE漏洞还存在:Exception in thread "main" java.net.ConnectException: Connection refused: connect

at java.net.DualStackPlainSocketImpl.connect0(Native Method)

at java.net.DualStackPlainSocketImpl.socketConnect(DualStackPlainSocketImpl.java:79)

at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)

at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)

at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)

at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:172)

at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)

at java.net.Socket.connect(Socket.java:589)

at java.net.Socket.connect(Socket.java:538)

at sun.net.NetworkClient.doConnect(NetworkClient.java:180)

at sun.net.www.http.HttpClient.openServer(HttpClient.java:432)

at sun.net.www.http.HttpClient.openServer(HttpClient.java:527)

at sun.net.www.http.HttpClient.(HttpClient.java:211)

at sun.net.www.http.HttpClient.New(HttpClient.java:308)

at sun.net.www.http.HttpClient.New(HttpClient.java:326)

at sun.net.www.protocol.http.HttpURLConnection.getNewHttpClient(HttpURLConnection.java:1202)

at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1138)

at sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1032)

at sun.net.www.protocol.http.HttpURLConnection.connect(HttpURLConnection.java:966)

at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1546)

at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1474)

at com.sun.org.apache.xerces.internal.impl.XMLEntityManager.setupCurrentEntity(XMLEntityManager.java:647)

at com.sun.org.apache.xerces.internal.impl.XMLEntityManager.startEntity(XMLEntityManager.java:1304)

at com.sun.org.apache.xerces.internal.impl.XMLEntityManager.startDTDEntity(XMLEntityManager.java:1270)

at com.sun.org.apache.xerces.internal.impl.XMLDTDScannerImpl.setInputSource(XMLDTDScannerImpl.java:264)

at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl$DTDDriver.dispatch(XMLDocumentScannerImpl.java:1161)

at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl$DTDDriver.next(XMLDocumentScannerImpl.java:1045)

at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl$PrologDriver.next(XMLDocumentScannerImpl.java:959)

at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl.next(XMLDocumentScannerImpl.java:602)

at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl.scanDocument(XMLDocumentFragmentScannerImpl.java:505)

at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:841)

at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:770)

at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.java:141)

at com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:243)

at com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderImpl.parse(DocumentBuilderImpl.java:339)

at javax.xml.parsers.DocumentBuilder.parse(DocumentBuilder.java:121)

at com.tencent.common.XMLParser.getMapFromXML(XMLParser.java:74)

at com.tencent.common.XMLParser.main(XMLParser.java:93)

如果修复了漏洞:

会提示:Exception in thread "main" org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 10; 将功能 "http://apache.org/xml/features/disallow-doctype-decl" 设置为“真”时, 不允许使用 DOCTYPE。

at com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:257)

at com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderImpl.parse(DocumentBuilderImpl.java:339)

at javax.xml.parsers.DocumentBuilder.parse(DocumentBuilder.java:121)

at com.tencent.common.XMLParser.getMapFromXML(XMLParser.java:93)

at com.tencent.common.XMLParser.main(XMLParser.java:112)