The website accept the upload of GPX file. The GPX file format is a XML document containing a list of positions with the instant speed, time and elevation.
Wednesday, June 25, 2014
Identifying Xml eXternal Entity vulnerability (XXE)
Here is a small writeup on how a XXE was discover on the website RunKeeper.com. The website, as the name suggest, keep track of your trainings (running, cycling, skying, etc.) The vulnerabilities presented were fixed on June 10th 2014.
The website accept the upload of GPX file. The GPX file format is a XML document containing a list of positions with the instant speed, time and elevation.
The website accept the upload of GPX file. The GPX file format is a XML document containing a list of positions with the instant speed, time and elevation.
Subscribe to:
Posts (Atom)