CVE-2012-4554

Drupal 7.x < 7.16 - Arbitrary File Read via OpenID Module XRDS DOCTYPE Declaration

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-4554. PoCs published by Reginaldo Silva, juan vazquez, including Metasploit module auxiliary/gather/drupal_openid_xxe.

AI-analyzed exploit summary This Metasploit module exploits an XXE vulnerability in Drupal's OpenID module by crafting a malicious XRDS file to read arbitrary files from the server. It tests for the vulnerability and extracts file contents via XML entity injection.

Description

The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.

Exploits (1)

metasploit WORKING POC
by Reginaldo Silva, juan vazquez · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/drupal_openid_xxe.rb

This Metasploit module exploits an XXE vulnerability in Drupal's OpenID module by crafting a malicious XRDS file to read arbitrary files from the server. It tests for the vulnerability and extracts file contents via XML entity injection.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Drupal 7.15 and 7.2 with OpenID module enabled
No auth needed
Prerequisites: OpenID module enabled on Drupal · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/10/29/4
Patch, Vendor Advisory x_refsource_confirm
http://drupal.org/node/1815912
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/10/30/5

Scores

EPSS 0.1581
EPSS Percentile 96.5%

Details

CWE
CWE-264
Status published
Products (16)
drupal/drupal 7.0 (16 CPE variants)
drupal/drupal 7.1
drupal/drupal 7.2
drupal/drupal 7.3
drupal/drupal 7.4
drupal/drupal 7.5
drupal/drupal 7.6
drupal/drupal 7.7
drupal/drupal 7.8
drupal/drupal 7.9
... and 6 more
Published Nov 11, 2012
Tracked Since Feb 18, 2026