razvanclaudiu/ktor-xxe-poc

GitHubRepository PoCExploit

PoC files

14 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a proof-of-concept exploit for CVE-2023-45612, an XXE vulnerability in JetBrains Ktor. It provides a complete vulnerable server application and a malicious XML payload designed to read arbitrary files from the server's filesystem and return their contents in an HTTP response.

Backdoor review

No backdoor observed in reviewed code

The repository is a proof-of-concept (PoC) for CVE-2023-45612, an XML External Entity (XXE) vulnerability in JetBrains Ktor. All supplied text files (README, build scripts, and Kotlin source code) describe or implement a deliberately vulnerable Ktor server for educational purposes. The code sets up a single POST endpoint that parses XML using a vulnerable default configuration, which is the expected behavior for demonstrating the CVE. No concealed executable behavior, persistence mechanisms, credential theft, or unrelated payloads were observed in the reviewed text evidence. One binary file (gradle-wrapper.jar) was not analyzed, which is a standard build tool component.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesKotlinXML
Target softwareJetBrains Ktor
Attack typesXML External Entity (XXE)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact includes a complete, runnable vulnerable server and a specific malicious XML payload designed to trigger an XXE vulnerability and exfiltrate file contents. The README explicitly describes this as an exploit and provides step-by-step instructions to execute it, including the expected output of the exfiltrated file.

README.md:2README.md:90-109src/main/kotlin/Application.kt:13-16src/main/kotlin/Routing.kt:21-24

Requirements

  • A Ktor server running version < 2.3.5 with the ContentNegotiation plugin configured using the default xml() serializer.README.md:6src/main/kotlin/Application.kt:13-16
  • An attacker must be able to send an HTTP POST request with a crafted XML payload to the vulnerable /message endpoint.README.md:94-101src/main/kotlin/Routing.kt:21-23

Observed behavior

  • The server application is configured with a vulnerable XML parser that does not disable external entity processing.src/main/kotlin/Application.kt:13-16README.md:36
  • The exploit payload defines an external entity referencing a local file (secret_file.txt) and uses it within the XML message body.README.md:96-101
  • Upon receiving the malicious XML, the server parses the external entity, reads the contents of the specified file, and includes it in the HTTP response.README.md:107-109src/main/kotlin/Routing.kt:23-24
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerable Configuration
ContentNegotiation plugin with xml() serializer in Ktor 2.3.4The Application.kt file installs the ContentNegotiation plugin with the xml() serializer, which is the vulnerable default configuration described in CVE-2023-45612.src/main/kotlin/Application.kt:13-16
Vulnerable Endpoint
POST /message endpoint that parses XML request bodyThe Routing.kt file defines a POST endpoint that receives and deserializes XML into a Message object, which is the attack vector for the XXE vulnerability.src/main/kotlin/Routing.kt:21-24
Exploit Instructions
README.md describes how to craft a malicious XML payload with an external entity to read arbitrary filesThe README provides step-by-step instructions for exploiting the XXE vulnerability, including the exact XML payload and curl command, which is consistent with a legitimate PoC.README.md:90-110
Review boundaries

What the analysis did not establish

  • One binary file (gradle-wrapper.jar) was not analyzed, but it is a standard build tool wrapper and not part of the exploit logic.
  • The analysis is based solely on the provided source code and documentation; the code was not executed.
  • One binary file (gradle/wrapper/gradle-wrapper.jar, 43764 bytes) was not analyzed. It is a standard Gradle Wrapper JAR, but its exact contents are unverified.
  • Seven unclassified files (totaling 10075 bytes) were not included in the text evidence and were not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1