# XXE on sms-be-vip.twitter.com in SXMP Processor

XXE in Cloudhopper SXMP servlet on sms-be-vip.twitter.com let an attacker read local files and make outbound web requests.

- Payout: hidden
- Severity: medium
- Program: X / xAI
- Found by: joshbrodienz
- Disclosed: 2017-07-26
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/248668
- Library page: https://bugbountylibrary.com/r/h1%3A248668
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:medium tech:java technique:recon technique:source-review vuln:ssrf vuln:xxe

**Target:** Cloudhopper SXMP servlet endpoint /api/sxmp/1.0
**Root cause:** The SXMP XML parser resolves external entities, so a SYSTEM entity in the DOCTYPE is expanded and its content reflected in an error message.
**Steps:**
1. Send `POST /api/sxmp/1.0` with `Content-Type: text/xml` to sms-be-vip.twitter.com.
2. Include a DOCTYPE defining `<!ENTITY file SYSTEM "file:///etc/passwd">`.
3. Reference `&file;` inside `<operatorId>` in a deliver operation.
4. Server returns the file contents in the error message for operatorId conversion.
5. Replace the file URI with an http URL to trigger outbound requests (SSRF).
**How found:** Identified the host via Google indexing and certificate transparency, mapped the running code to the open-source twitter/cloudhopper-commons project, then tested XML entity expansion.
**Exploitation:** Attacker sends a crafted XML deliver request; the entity is expanded and the file contents leak in the error response. Swapping the entity URI for a URL makes the server perform outbound requests, enabling internal port scanning.
**Escalation:** Potential pivot: read credentials/certificates on host to bypass auth or access other Twitter properties; use SSRF for internal port scanning.
**Insight:** Fingerprint obscure telecom/SMPP gateways against their open-source upstream (cloudhopper-commons) to predict parser behavior, then test XXE on XML API endpoints whose errors echo parsed fields.