# 0day writeup: XXE in uber.com

Unauthenticated XXE in Code42 CrashPlan's /api/SsoAuthLoginResponse SAMLResponse parameter let an attacker read server files and backup logs of all domain users.

- Payout: $9,000
- Severity: high
- Program: Uber
- Credited: -
- Disclosed: 2017-01-24
- Write-up quality: 6/10
- Original: https://httpsonly.blogspot.com/2017/01/0day-writeup-xxe-in-ubercom.html
- Library page: https://bugbountylibrary.com/r/blog%3Ahttpsonly-blogspot-com-2017-01-0day-writeup-xxe-in-ubercom-html
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:blog sev:high tech:java technique:oob-exfil technique:recon vuln:info-disclosure vuln:xxe

**Target:** CrashPlan backup server API endpoint /api/SsoAuthLoginResponse (port 4285)
**Root cause:** The SAMLResponse GET parameter is base64-decoded and parsed as XML with external entity resolution enabled, and the endpoint requires no authentication.
**Steps:**
1. Enumerate documented Code42 API methods and probe for unauthenticated access; find /api/SsoAuthLoginResponse accepts GET SAMLResponse.
2. Build XML with a DOCTYPE declaring an external entity pointing to attacker host on a non-filtered port (80/443 filtered).
3. Base64-encode the XML and send as `GET /api/SsoAuthLoginResponse?SAMLResponse=<b64>` to https://backup.uberinternal.com:4285.
4. Run xxe-ftp server (HTTP listener on 8088, FTP listener on 8077) to receive OOB exfil since Java resolves entities via FTP.
5. Use file:// entity to read /home/ and backup log directories, exfiltrating contents over FTP.
**How found:** Recon of Uber's bug bounty scope surfaced backup.uberinternal.com:4285; /api/serverEnv revealed CrashPlan 5.2.0 with no public CVEs, so author read Code42 docs, extracted all API methods, and brute-forced them for unauthenticated access, finding SsoAuthLoginResponse which parses base64 XML.
**Exploitation:** Attacker sends crafted base64 SAMLResponse containing external entities; the Java server resolves them, fetching attacker-controlled DTD over HTTP and exfiltrating local file contents via FTP to the attacker's xxe-ftp server, yielding directory listings and backup logs of domain users.
**Escalation:** Pivoted from reading /home/ to locating backup log folders, demonstrating read access to backup files of nearly all domain accounts; Shodan showed the same port exposed at a major security firm.
**Insight:** When a vendor has no published CVEs, mine its public API docs for endpoints that parse structured input (SAML/XML) and test them unauthenticated; Java XML parsers often allow OOB entity resolution, so use an FTP-based OOB channel when egress ports 80/443 are filtered.