Description

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-11T16:17:50.560Z",
  "pubdate": "2026-09-11T16:17:50.560Z",
  "executiveSummary": "MoguBlog versions up to 6.2 are susceptible to an XML External Entity (XXE) injection vulnerability within the WeChat callback handler located at POST /wechat/wechatCheck.\nThis vulnerability stems from the improper configuration of the dom4j SAXReader, which fails to restrict Document Type Definition (DTD) processing or external entity resolution.\nThe flaw allows unauthenticated remote attackers to perform unauthorized file system access or execute Server-Side Request Forgery (SSRF) by injecting malicious DOCTYPE declarations into the request body.\nThe application reflects resolved entity contents within its error responses, facilitating data exfiltration.\nSuccessful exploitation poses a critical risk to confidentiality, potentially allowing attackers to read sensitive local files, such as configuration files or credentials, depending on the application's runtime permissions.\nNo authentication or specific privileges are required to reach the vulnerable endpoint, making it highly exploitable over the network.",
  "technicalDetails": "The vulnerability is located in the WeChat callback processing logic, specifically within the WechatRestApi.index() method. When a POST request is received at /wechat/wechatCheck, the raw request body is passed directly to the SignUtil.xmlToMap() utility function for parsing.\nThe root cause is the instantiation of an unhardened dom4j SAXReader. In the default configuration, SAXReader permits the processing of DTDs and the resolution of external entities. Because the implementation lacks explicit security configurations to disable these features, the underlying XML parser is susceptible to malicious XML input.\nAn attacker can exploit this by crafting an XML payload containing a malicious DOCTYPE definition. By declaring an external parameter entity, an attacker can instruct the XML parser to fetch content from local URIs or remote URLs.\nThe attack flow proceeds as follows: First, the attacker sends a POST request containing the malicious XML payload to the /wechat/wechatCheck endpoint. Second, the WechatRestApi.index() method captures the raw payload and passes it to the vulnerable SignUtil.xmlToMap() function. Third, the dom4j SAXReader interprets the DOCTYPE declaration, triggering the resolution of the external entity defined by the attacker. Fourth, the parser retrieves the content of the referenced file or resource. Finally, because the application reflects the results of the parsing process—including resolved entities—within its error messages or responses, the attacker can view the contents of arbitrary local files or confirm the success of outbound SSRF requests.\nThe vulnerability resides in the interaction between the application's input handling and the insecure parser configuration. The scope of impact is limited by the system user privileges under which the MoguBlog process is executing. If the service runs with elevated permissions, the risk of sensitive information disclosure is significantly increased, as the attacker may access system-level configuration files or environment variables. The lack of authentication requirements on the /wechat/wechatCheck endpoint ensures that any network-adjacent attacker can reach the vulnerable code path."
}