Dojo CTF Challenge #42 Hex Color Palette XXE File Disclosure...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.yeswehack.com/dojo/dojo-ctf-challenge-winners-42
• Blog Title: Dojo CTF Challenge Add Pentesting HSQLDB Page  #42: Hex Color Palette XXE File Disclosure Exploit
• Suggested Section: generic-hacking/XML-External-Entity-XXE.md

🎯 Content Summary

Hex Color Palette Dojo CTF Challenge

The “Hex Color Palette” Dojo CTF challenge features a Python web application that uses lxml.etree.XMLParser(load_dtd=True, resolve_entities=True) to parse user-supplied XML and render hex colours via Jinja2. Unvalidated XML input with external DTD loading and entity resolution enabled leads to an XML External Entity (XXE) vulnerability, allowing arbitrary file disclosure (e.g., /tmp/flag.txt).

Co...

🔧 Technical Details

Error-based XXE file-disclosure via parameter entities in lxml (<5.4.0) with load_dtd=True and resolve_entities=True: load a local DTD, override an undefined entity with %flag SYSTEM 'file:///…', nest an %error entity referencing a non-existent path appended with the flag, then expand it to trigger a parser error that leaks the full path (and flag) in the exception. 🎁 PoC

Parameter-entity XXE bypass in updated lxml/libxml2: define <...

🤖 Agent Actions

Updated the existing XXE page to include:

1. New subsection “Python lxml Parameter-Entity XXE (Error-Based File Disclosure)” describing:
   • Detailed exploitation steps for lxml < 5.4.0
   • Hardening bypass for lxml ≥ 5.4.0 using libxml2 behaviour
   • Complete PoCs, mitigation tips, key takeaways

2. Added the related references:
   • YesWeHack Dojo CTF Add Pentesting HSQLDB Page  #42 write-up
   • lxml bug #2107279 report

Changes committed to:
src/pentesting-web/xxe-xee-xml-external-entity.md

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 848
• MD files fixed: 4

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.yeswehack.com/dojo/dojo-ctf-challenge-winners-42

Content Categories: Based on the analysis, this content was categorized under "generic-hacking/XML-External-Entity-XXE.md".

Repository Maintenance:

• MD Files Formatting: 848 files processed (4 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge