# XXE at ecjobs.starbucks.com.cn/retail/hxpublic_v6/hxdynamicpage6.aspx

Starbucks China jobs site allowed arbitrary file upload via allow_file_type_list tampering, then parsed uploaded XML with external entities, enabling XXE and stored XSS.

- Payout: hidden
- Severity: critical
- Program: Starbucks
- Found by: johnstone
- Disclosed: 2019-11-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/500515
- Library page: https://bugbountylibrary.com/r/h1%3A500515
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:critical tech:dotnet tech:windows technique:param-pollution vuln:file-upload vuln:xss vuln:xxe

**Target:** ASP.NET file upload and XML page service (hxdynamicpage6.aspx, hxxmlservice6.aspx) on IIS
**Root cause:** Upload endpoint trusted a client-supplied allow_file_type_list parameter to decide permitted extensions, and the XML page service parsed user-uploaded XML without disabling DOCTYPE/entities or external DTD access.
**Steps:**
1. Log in, open personal info settings, click Upload Image.
2. Intercept the HTTPS upload request in Burp.
3. Add `html;` to the `allow_file_type_list` parameter (or delete it), and change the filename suffix from `.jpg` to `.html`.
4. Visit the returned URL e.g. `https://ecjobs.starbucks.com.cn/retail/tempfiles/temp_uploaded_<uuid>.html` to confirm stored XSS.
5. Upload a malicious XML file, then request `POST /retail/hxpublic_v6/hxdynamicpage6.aspx?_hxpage=tempfiles/temp_uploaded_<uuid>.xml&max_file_size_kb=1024&allow_file_type_list=xml;jpg;jpeg;png;bmp;`
6. Alternatively POST to `/retail/hxpublic_v6/hxxmlservice6.aspx` with `HX_PAGE_NAME="tempfiles/temp_uploaded_<uuid>.xml"`.
7. Observe the server fetching the attacker's external DTD, confirming XXE.
**How found:** Noticed the photo upload feature and hypothesized the extension allowlist was client-controlled; tested by editing allow_file_type_list and suffix, then probed whether the XML parser honored DOCTYPE/entities and external DTDs.
**Exploitation:** Attacker uploads HTML for stored XSS against other users, and uploads XML with external entities that the server parses, causing outbound requests to attacker infrastructure for DTD retrieval and potential file/SSRF data exfiltration.
**Escalation:** On IIS/ASP.NET/Windows, XXE could be leveraged for NTLMv2 hash capture and further internal domain compromise.
**Insight:** When an upload endpoint passes an allowlist as a request parameter, treat it as attacker-controlled; also test whether uploaded XML is later parsed by server-side page loaders (e.g. _hxpage params) that may honor DOCTYPE.