feat: add multipart/form-data XXE detection support#7432
Conversation
Port logic from PR zaproxy#2864 to detect XXE vulnerabilities when XML content is uploaded as part of a multipart/form-data request. Uses VariantMultipartFormParameters to parse and inject payloads into multipart bodies while preserving other form parts. Includes import reorder and state reset fix for scanner reuse. Signed-off-by: Cedric Buissart <cbuissar@redhat.com>
|
All contributors have signed the CLA ✍️ ✅ |
|
Great job! No new security vulnerabilities introduced in this pull requestUse @Checkmarx to interact with Checkmarx PR Assistant. |
Neither is true. |
|
I have read the CLA Document and I hereby sign the CLA |
|
I believe this should override scan(NameValuePair), checking the type of the name value pair, so that users' input variant selection is respected. |
Rework multipart handling to use AbstractAppParamPlugin's variant framework instead of manually creating VariantMultipartFormParameters. This ensures the user's input vector selection is respected. - Change XxeScanRule to extend AbstractAppParamPlugin - Override scan(List<NameValuePair>) to identify XML file parts by their declared content-type - Override scan(HttpMessage, NameValuePair) to run XXE attacks on matching multipart file parameters - Replace multipartVariant.setParameter() with the inherited setParameter() from AbstractAppParamPlugin - Restore Javadoc comments on scan(), localFileReflectionAttack(), and localFileInclusionAttack() Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Thanks for the clarification |
Thanks! I adapted the code based on your suggestion. I hope I got it right this time |
4 participants
Port logic from PR #2864 to detect XXE vulnerabilities when XML content is uploaded as part of a multipart/form-data request. Uses VariantMultipartFormParameters to parse and inject payloads into multipart bodies while preserving other form parts.
Includes import reorder and state reset fix for scanner reuse.
Overview
The original PR #2864 was apparently in a working state, but abandoned (and no longer relevant since aimed at ascan-beta, while XXE was moved to ascan). This PR steals the idea, adapting the code for the latest ascan code.
I tested it against juice-shop, and it worked:
step 1: upload a random XML file in the "complaints" form
step 2: attack the file-upload() POST endpoint, and make sure that XXE policy is enabled
Related Issues
zaproxy/zaproxy#8817
zaproxy/zaproxy#1190