The Hunt for XXE to LFI: How I Uncovered CVE-2019–9670 in a Bug Bounty Program

A few months ago, during one of my late-night bug bounty hunting sessions, I stumbled upon a critical vulnerability that could lead to a full server takeover. The target was a well-known program, and I was determined to dig deep. This is the story of how I discovered the XXE to LFI vulnerability (CVE-2019–9670) in my target program.

The Discovery

While probing the target, I noticed something peculiar about the way their server handled XML inputs. My initial scans revealed that the server was running Synacor Zimbra Collaboration Suite version 8.7.x, which I knew had some known vulnerabilities. Specifically, CVE-2019–9670 caught my eye — an XXE (XML External Entity) vulnerability that could lead to Local File Inclusion (LFI).

Understanding the Vulnerability

The CVE-2019–9670 bug exists in the mailboxd component of Synacor Zimbra Collaboration Suite. This XXE vulnerability allows an attacker to inject malicious XML content that can read sensitive files on the server. If exploited, this flaw could lead to complete server compromise, allowing an attacker to read, create, modify, and delete data on the target server.

Steps to Reproduce

Armed with this knowledge, I decided to test the vulnerability. Here’s how I did it:

3. Craft a malicious payload to exploit the XXE vulnerability:

4. Send the payload and observe the response. If the server responds with file contents like /etc/passwd, you’ve confirmed the vulnerability.

5. Use the following CURL command to test with the crafted payload:

If you receive a response containing sensitive file data, congratulations, you’ve uncovered a critical flaw.

Automating the Hunt

To streamline the process, I built a Python tool specifically for detecting this vulnerability. You can install it using pip and automate your testing:

ToolPOC: CVE-2019–9670 on PyPI

Conclusion

After confirming the vulnerability, I reported it to the target program, and they promptly patched the issue. This experience reinforced my belief in continuous learning and adapting, especially in the dynamic field of cybersecurity. If you’re interested in VAPT services or enrolling in my cybersecurity course, feel free to reach out.

Stay safe, and happy hunting!

POC :

POC by: @karthithehacker
Mail: contact@karthithehacker.com
Website: https://www.karthithehacker.com/

If you’re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com.

For enrolling my cybersecurity and Bugbounty course,

WhatsApp +91 82709 13635.

Twitter: https://twitter.com/karthithehacker

Instagram: https://www.instagram.com/karthithehacker/

LinkedIn: https://www.linkedin.com/in/karthikeyan--v/

Website: https://www.karthithehacker.com/

Github : https://github.com/karthi-the-hacker/

npmjs: https://www.npmjs.com/~karthithehacker

Youtube: https://www.youtube.com/@karthi_the_hacker

Thank you

Karthikeyan.V