# [HTA2] XXE on https://███ via SpellCheck Endpoint. Authenticated XXE in DoD RapidSpell spell-check endpoint allows local file read, internal SSRF, and NTLM hash theft via crafted XML entity. - Payout: hidden - Severity: critical - Program: U.S. Dept Of Defense - Found by: cdl - Disclosed: 2023-05-15 - Write-up quality: 6/10 - Original: https://hackerone.com/reports/715949 - Library page: https://bugbountylibrary.com/r/h1%3A715949 - Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:critical tech:dotnet technique:source-review vuln:ssrf vuln:xxe **Target:** ASP.NET RapidSpellHelpFile.aspx spell-check endpoint **Root cause:** The spell-check endpoint parses attacker-supplied XML with external entity resolution enabled, so SYSTEM entities in the DOCTYPE are expanded and their contents reflected in the response. **Steps:** 1. Authenticate to https://███ and capture session cookies. 2. POST to `/Kview/CustomCodeBehind/Base/Utilities/RapidSpellHelpFile.aspx` with `Content-Type: text/xml`. 3. Send XML with `]>` and reference `&a;` inside ``. 4. Observe file contents reflected in the response. 5. Swap the SYSTEM URI for `http://internal-host/` or an attacker-controlled UNC path to trigger SSRF or NTLM auth. **Exploitation:** Authenticated user submits crafted XML to the spell-check endpoint; the parser resolves the external entity, embedding local file contents or internal HTTP responses into the spell-check output returned to the attacker. Pointing the entity at a UNC path forces the server to authenticate to an attacker SMB listener, leaking NTLM hashes. **Escalation:** Chained file read to internal SSRF and NTLM hash capture; also noted DoS by exhausting parser resources. **Insight:** Legacy ASP.NET spell-check/grammar components (RapidSpell, etc.) often accept raw XML with DTDs enabled; grep for `.aspx` endpoints taking `text/xml` and try a SYSTEM entity in ``-style fields.