CVE-2022-2414
HIGH EXPLOITED NUCLEIDogtag PKI - XML External Entity File Disclosure via Crafted HTTP Request
Title source: manualExploitation Summary
CVE-2022-2414 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 5 public exploits from researchers including amitlttwo, geniuszly, superhac. A Nuclei detection template is also available.
AI-analyzed exploit summary This is a functional proof-of-concept exploit for CVE-2022-2414, an XXE vulnerability in pki-core. It sends a crafted XML payload to retrieve the contents of /etc/passwd and generates a professional report if successful.
Description
Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
Exploits (5)
This is a functional proof-of-concept exploit for CVE-2022-2414, an XXE vulnerability in pki-core. It sends a crafted XML payload to retrieve the contents of /etc/passwd and generates a professional report if successful.
This is a functional PoC for CVE-2022-2414, demonstrating an XXE vulnerability in the target software. It sends a crafted XML payload to read sensitive files (e.g., /etc/passwd) from the server.
This PoC demonstrates an XXE (XML External Entity) vulnerability in FreeIPA's certificate enrollment endpoint, allowing arbitrary file read via a crafted XML payload. The exploit sends a malicious XML request to the target endpoint to retrieve the contents of /etc/passwd.
This PoC exploits an XXE (XML External Entity) vulnerability in the target software to read arbitrary files from the server. The payload is crafted to read /etc/passwd, demonstrating the vulnerability.
This repository contains a functional Python script that exploits an XXE vulnerability (CVE-2022-2414) to read sensitive files from a target server. The script sends a crafted XML payload to a specified endpoint and retrieves the response.
Nuclei Templates (1)
title:"Identity Management" html:"FreeIPA" || http.title:"identity management" html:"freeipa"
title="Identity Management" || title="identity management" || title="identity management" html:"freeipa"
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N