XXE
Medium · Upload

The Avatar That Reads Your Files

DropZone lets members upload a profile picture. They accept PNG, JPG… and SVG, because 'it's just an image'. The upload handler parses every SVG on the server to check it's valid (dimensions, size) — and that parser processes external entities. An SVG is XML, so a picture can carry a DOCTYPE.

Objective

Upload an SVG avatar that reads a file on the server (try /etc/passwd, or an app config) and shows it back in the response.

Target

DropZone

Launch target

Submit flag