XXE
Medium · Conversion

The Converter That Coughs Up Files

DropZone's flagship feature: upload a Word document (.docx) or an XML file and it converts it to PDF or plain text. A .docx is a ZIP of XML files, and the conversion engine parses every one of them. It also supports XML uploads directly for 'spreadsheet import'. The converter needs to read files on the server to work — so it has file access built in.

Objective

Read a file on the server by submitting an XML document to the converter (try the app's own config, e.g. /opt/dropzone/config.xml).

Target

DropZone

Launch target

Submit flag