trishika / DroidUPnP

DroidUPnP is an upnp control point application for android.
GNU General Public License v3.0
150 stars 61 forks source link

XML external entity (XXE) vulnerability: Out-of-Band XXE in SSDP Processing #76

Open Sami32 opened 6 years ago

Sami32 commented 6 years ago

The XML parser don't disable the inline DTDs parsing by default or do not provide a mean to disable it AFAIK.

The XML parsing engine in SSDP/UPNP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Unauthenticated attackers on the same LAN can use this vulnerability to:

Exploitation can be demonstrated using evil-ssdp (https://gitlab.com/initstring/evil-ssdp).