Enable build support by adding .buildspec.yml
| assets | Loading last commit info... | |
| README.md | ||
| c.html | ||
| c2.svg | ||
| c3.xml |
README.md
简介
- CVE-2023-4357-Chrome-XXE
- Chrome XXE 漏洞 POC
- 实现对访客者本地文件读取
展示
复现
- 下载并运行chrome
wget https://edgedl.me.gvt1.com/edgedl/chrome/chrome-for-testing/114.0.5735.90/linux64/chrome-linux64.zip
unzip chrome-linux64.zip
./chrome-linux64/chrome --no-sandbox
- 启动web服务
wget https://codeload.github.com/xcanwin/CVE-2023-4357-Chrome-XXE/zip/refs/heads/main -O CVE-2023-4357-Chrome-XXE.zip
unzip CVE-2023-4357-Chrome-XXE.zip
python3 -m http.server 8888 -d CVE-2023-4357-Chrome-XXE-main
- 浏览器访问
http://127.0.0.1:8888/c.html