File Upload XXE to Initial Access

This beginner lab demonstrates how an XML External Entity (XXE) vulnerability in a file upload feature can lead to cloud infrastructure compromise. You test a document processing system that parses XML-based files, weaponize an SVG upload to read a Lambda function's environment file, and exfiltrate the temporary AWS credentials it exposes. Those credentials are then used to enumerate S3 and pull sensitive customer data from a SQLite database.

Huge Logistics has rushed a new data and analytics processing unit into production under tight deadlines. You assess the new data processing system to show why security must be built into the development process.

• Basic Linux command line knowledge
• Familiarity with the AWS CLI
• Basic understanding of XML and web requests

• Perform web enumeration with Nmap and identify AWS-hosted infrastructure via whois
• Analyze client-side JavaScript and inspect requests with Burp Suite Repeater
• Test for and exploit an XXE vulnerability using a malicious SVG file
• Read a Lambda function's /proc/self/environ to extract temporary AWS credentials
• Configure and validate stolen credentials with aws sts get-caller-identity
• Enumerate an IAM role and pivot to a referenced S3 bucket
• Extract data from a SQLite database using the AWS CLI and the sqlite3 client

File upload to XXE vulnerabilities are a significant threat to web applications that process XML data, enabling file retrieval, SSRF, and data theft. In serverless environments a single XXE can expose a Lambda role's temporary credentials and open the door to broader cloud compromise.