安全研究
CVE-2023-4357 Chrome XEE on WebBrowsers：从 XML 外部实体到任意文件读取
Thinking
2024-01-15
2 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
Chrome 浏览器的 XML 解析器在处理用户可控的 XML 文档时未禁用外部实体加载，攻击者通过构造恶意 XML 读取本地文件。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9247681cc8f2d78cabe69247dd3a70d12769500098e8f3d55c63e34986d15464db5a5fd59dab2dada1cc1584d340ae50c8b561e9fe215f3f92c2ecd0ccff88824e77f6f7b00c9ec6e61ea98c4437451981f7f4513233ffa48b85f3ee348aef8f89832d695eb44bd7bbfc8e99f95a997b32c483996311f5fff76d9df3b3949c4e161510382e066a15745448c1ee16a15481c25e57a32463b90c91d46e670b3fce974b7d02001af3b1331d04143fca6b6f6c0fe3b6d214f3a84baabba3fa47e67843e00081aa45908a314f28779579d752a6fdc26a615e099811b20881bd7bc6f6a55a0d16d47ce3cd269ad7ce839c6ed200acaed1ef648d9a28f8fe5b6713b201e0a6962bf87d09c0d4819f4ce532344f81962d486a26b02a818957f3315e0b3963ad6da653782f4f902e16b3d9db1b84074682bf3d7189a81a0103d97ba608f0f0578f6f05ce3b234c4a88dd2facaa2b4a5f65571468ad81bff2e6779b4a2d6adf9b5643f7602b5c927ef156c95b61806c4652695193320dbad1802f9c0eb6651084cf5989b9abc9db6088e2098426957d204e0ef242438bce3c6ffdb890a2c39822756d4d0b674951cc6a7099951daaad3439c8c04647f4dca9aecdad44959688253b86a4265af5a73fd1f864c88100da40a8e697a1be9b5e2ae78edfabf334378f7394b88581a2fa446181963959852b564732a6110193a2d6715abd694628ebf6133b16b35ea3dbffbada80c9aca30882faf5fe48afbb418e18af38e1ea1e20e6e959f767e700503ce7577835f71d86724ab10e89a6f87dcdeac4005bb8ad4089ddc89c5ced3a49debdeb2787a685be4fed02279b2e0e1d2ed7ea4ef071794e2c111af0f4ebddd13d571c3b0beeafc0ce874ed1237e6281d9f7c8e0288c7d5d2001124587ea15db29fd5618cc0950afc94447b1071db5a037f5dabc4960c09361e4fd5195a6f51152602facdb48e4d660718cc6732dddc9941c3d97d7486de9542933e09bcc71bcd1d88494f2eb03c43911cef85f3a7fca0134780f7dc6f6ffff45665deccc9082d37c5520f6d94bda9f87d7e7de563cb72d4bff3f63de4a5246454856a81d4107bb3fc78423a1f5b0a8fdf1f1c15342113f2411db7399c9efac8f353832f719a995510270ddadf5b25d4a5c5cfd97e77b1551af6a415efd0cfbf6c55b59abda8d477135d228185c00d1f84239d9231a3567800fd0ed91bdcfd0ca7ad7b9653185eaadc3e6147e2ddf60289947246061fc3f73fa55c82387c5e1d0e6d7d96b54b13ca7af23b6f20171cdaf3e2104c0a8d059c5103c762ef71c69190c7f47728568532dbaed325431a38b2ba995d3f50a42b6ce607de4384321ce0172b1621b4975b2fb8962ff0848cbb8ff2d445e7339426cc1f7800a6a228e75a2d1a601a67de89da2531c5564dfbab7d0ba6f0ee01bb21bd3f2af5f00837962e74328f321c72b64b3389932568df7dffe0979e1878f4e125a9079cac0a6d3d31f6ae16e725a6175e47bc2f1a23e5ef8ecff74221ab354025f69dbefcca9d58bf7b01999c5d9187d1577e28d51a1975e91b63c12823ae37a41560bf48de6094ac232432842b226fa4980125f06d1d2f4660c56093f57324b97bdf722b36d82d7d9949d9414ffbcc11987ec31c18bb389a5f994fae9bdb4f0c9fa4d28fe3a39545a0c27c8604814e932463edb5b317794d2f8ae2effcbf538bc1b24742830830b5aeb79ceaacb188f8dc8191569e97ad6f1fe6ee75cdfb390872c83080cb075baf098c537ffb1af9a522d528025607d5f8d351aa24073d5a2f162082e1436637b61c651b7460e8e9fa063269372cd54c9a794cba11a5ba481d4511e86dc0824c976801e8ab4a4e0e1fefd7f32290c084f6a6fd0e4c946ddf853d45a59bd36fb91c0467b8506e4ecc46ea2c9c083e68d16423ef8edce045d3cf11524572063527765336b33c892e5988de8e92194f2bfb33cfb3df2a251b39a4087c1807b4ee3d70059ec69e86cbc281eb51095c617e0b938fd96910dbbec0dd4289886949a9f922f19ca4f150d1a692d34a0f7108979b8c3695d77c2ccbde5e74783ca04f235183812ef7336a9f3debac26b6bc4852dfcb24245896b649e6bf9de254fb136dfa03223e0ef78b69fa5841d58c8b8f5c3f9ce5dab6a1ad8010f62682df9afbd06ddd33f797f1a818b5347e66df4164888f5c5f2f706c9402a26045cba0622af1c8c2e7061f251cc141b6d57e7126692d6095bb613ef3e871fff32d8c26215a7a59a306e53da6479872e4bcfae33dbe5dc6b42318322d4383c96921d9e7fd60ca88b44f3baeb5d7e72a1a3eac1cebcf80c555fab1bc1f957ad88bfa9f1e2d79e8cc5e4a167c50c2b9806878871c47b85ec4500e3c8b57d148f4d5f213b5041c8bf9c64e3a47ac23136c47153510b671b290f40fed9c86e621dc4eace8dd034b3ec678fec1b41b8bb2c9cc6c55d6ea54d2ba46919c8f002a1f7957dca910eb368d1693b0b2a75538a513a7e18598598034442124aed4213240065aefc23c64e614490716cf98e864c953dfb03dfc92efa2fb816a04095ebf0f3d96b75534de13538e1bc9a44fc2c59b633045a0c144191a082b65df5ba4c7e0e0cb927a38e97de141e2479fc64bc94f60ed0a081d4623e3a3462c9fbf48789c87e0db5fe3d1d4e2741f8fe2c163515e3632f78d30c81941f578b63d9f3eb4d1ede89444a475205fba0702d2d5094304851a2b3fac7b3af38da79335bcaca76bfb2ce4f32d019d33493b5556d5481090633534c66061a95f350779a5e9702d49dd144ae336d9e846a4115ef3789900619b288eb925b620058919a3e8ef559841e7c00ec48b663d02e4158845e10afd5bb6f1039ecf060dd0591da6202d76cca9aa78e5c06751dc5927b17a24aef6bc495244ac9f9532ebb4e4771b5139ed3c07201b4ffbfdddf044024d148ecb8b64b66084d77b4481916f5ffbf20d54e024c8a5be96f987acc5eeeb6e0b5dc2520f9e2f45e365f5bd6e9821f6508929326b31225a0c391b6299b29a0b424bdbc44f75cfa2148ac69711f03ad40bd65072e2e26f4811d4579a138b6f2708e023407178268c5c0ae8a8622768dcb604fb7292a5d062a78b6adf43fed6a8830540d6c7513d065f75a0814ad7c3d2fa7602f344230c6517313a37f2c3bfc6576b4b48a85556aae0d17836f2a36bb2249f27387b23a414e45c1c0a06aeed0a6db6714b0ca74aa8d3043805d95cbb049a2c3f4a161eec4c5950c8ed3e0eded7998221260019833ee5ac2322c1ec26d9164b39a82a1a21505f7f087e1620c5119e626b8fff7695a49afe9aacbc07187878337faaf7a54e2c07f40292b2f37d5bb381fc1e97c3f2e2e31000d3e8e8519816e7a7a9cc08235baf093c0ee68e4d04c88c48a5827af46e44362fe533d0df0ba38658c7512cc0c7e81c5f403911cb1a4d1086b50d2757cb5998506c0780dcda827ad08b02da7383f17c6fb457b5ecfe8e3332ed720dc2d3bf874fe4bab8391c1c862d00010d790eed1cdd623257a5c6ab2081b072c3d387c0f34fa5e89f144ca09d142a2b1a0a4b654430833161a86dade686486c417756f0c51562507f82f2de7b5a2e76a3abebf113a101385c5fbbef65c356110c42d5970c30a5a5257b1c1da93c67501118a331efb78ca1f8ddb16ec119b390b9281f2aa3e19c87d221de98858dc6459e75dbfd8120ccb23357ee39cf2457eee628ca6fd0471165023229e4c3e8226ccb163a3712aa81791bea866d7d9fd59e25fd399fdcbda86b8b62db048dcf06ca89271a122a73217c81509f502b9ad4881df75f7151cfb5af76619e2488b2ed57782fa47784ef3e0e56a1bc1da9265266c992c5c069f180101436cd70c0d5c31d839b009010c8335e67749457bdda3318e1c63ca2ae84ee5c0de2a18b470030f60c033ecadfe5fb918b8a241e5c518e4a8bb19ed11feb1d0858d903ee62e0fe17016f9a870545088a0ae3e9ddfc91cdc7444fbe0f7e8c805b7e91357fbf67fe14e57470faa59ac143257224ddfcea583144e69e3ee1a97b6b160faa3bee086b42acfa88b9cc9d08156558a995f45a0dd410226ed4169c84378b2704aa9881ab8cafe5e3a4bd196663755cca2290b52afab923366b039e8c24df98eca01879ce74ef9822817ad4c8d71c8ffb52b020c9d3820ca9dbb119f9df42a6e9fbb2b4d88cf5d29ec01c4174f70f411634413ea8456757cb236101aaeabb165dc8695d4b6ba77fb777e25d7fd3e943c46768b60c76075e5a6b258b48ff8df5f75ccf74809f92c88647fcb7413e4e04cc4ce9bf1cfa1efe183b57fb27b6a6231407778af5572c4aa4c0535f7d2984f83e174643f4d1de845fd13e65f58c900a50c243e9b5db06b9c8c54cec0f612f5f5d2712c8d67e95d91caf3d1a1317b2fca0e1b2a564eea73f19ee382bfb08db3dec7e254b547e843c17216b2f5800881fafc4716f5cf54fe9b0737cb981a799ca62ec045f4b8e364882e3f9c28eb6bd009a05cce34b16442d20842faa742f04cf72acd8d44daf8e150d097ddbe3cd9c52b3cb45ab082959182cfc964b5dd63c6675d887212587815be89313f3034bce0ace8f5bc29398eeff54ca0033a9a97d13299c085af8411a01de892f48a48c39c549371ec36a6dd9691985384937a26e011057d78153cd0f032d7ecf392d48f732635551085b2f15f0bd98ce10a931091cc1be08f185a908529e67dc7faf0e20592f750c72727f2cbd9cff6037afb4f40b90c7c7715adebc9227012bbd39fd97f64f2f9367650ff5b901b5d7d0ae365e71dc9f4b5ff05fd2e3c9509f22c8c1809e6015f0cdcd65c9921d6c053e4e50f7de6e348ff0e4f1b06138e1819984bc775b0607857a4a8b2407bed0f789a03e28a24ba8bdaaa8d009b20f42946cb80f6bba9c67f13cc4ee85bd268a6e259529ed822013e974ccca4f0c2c956156130bcd3aca8b94ce6c06bbec12681cc455fc054677fcbe30e3eded56d614ffafeba1747ba0d55a2017651c32a53fc73ce272923a415bff0ca97cef81fe22ce43ac85736504a672ffb58befd01a5c85bf22b8fb6a2b947dd67d08cc9f5876040431d3df11b28610460b062f06e5cc8ff8ef6d9cb29be02ff7f9438f7ca6d2bfb98be3e5319a79ae5d428f878fb039a8cfa1165cd8d8464865f99f92b4fcadc8f20d90e7e7370107bc79b085bee21b789768d0d209ec3261e160f10ca655633ec56fa877e3d7f1d6be25cdc4e5d7be607187c63087bf82f06e0b732a38187c8830748f6cc3846a71c8fdfbd5a258a27208bf7bf19fe4cbfe86a59652532ee5f1770b451d308bc2d8971e91651348e287194c9b10cbb9957aed2f0811e1e7592eeea5b14e4b78d5a84f14a6d457684ebbb2092b50b8fccc347c695740430a407515fbadc9b5837370d7045344c506a2cbe5a2ff6d92ac43b2dbb7ef74534103e0aa7471f00308f59547287960a6c5803635261930021a508336b3d536f286066b88545cff547dbb5de9b52bd37528254db7453e49a211221685b09d7f1796ee6bf3f79ad86c7187046b4bd43af10056a8c9964aae99825359a5fb3adf532bb1b8b4fa05be892433cfd9f99b7c700cf0e43d346b9f47809fc4f30b74f08691fca1222b38750eb5e1f9a45f04a753fe16a54fdb61b85275ab8e8f8296f2acce1b955cb23436f7af0e100c261aab843e9e1667a98ce70f08ce7da433b6ef10cfbaacecfbe965fa591900447308357dc3695e9eaafc14c0c9259cb4b6e2298b14a3b4181f82e7e0f3136fc0e6cd762d7ffdbb15f33cea45709679a9667b96559604ebb875f9bba0e1e6df5e49ca00e81894775434863ab2b762a48c22cb0d9e7e863d6617fc1086a2d1503ebcf1656ad61f19ccc7979582eb5c7e86cde0248e230636bc117ef959e9a46c62b9b8633473558762adbae65e37378f28d51fd5bf08203007f6ed0118741cc7959fd4b45547f65b0616b5863581522149981a8a74274a59fa1297968ea0be5660bf6891fb5c0e99ef6f83b7f82f76c5b0d3a887fc793caa39ccaaf6d659994d92ebcbb1ae8a1c5727069e3ea13612cdcdb364634ca8fcfd6e42ea698642c2e8c6af6de036f574a6edb459d3271faae7bdea46b918fd1a7fc33d45171f3afa81a86b7d1c844a49221dd95ea6d93c638ffc1d1ee00776fbbcf29f4b2ad93e2b5a84233485c8cf6431186704d1aad10cabc5e6a445feb6d1c674ce7945140cc2dcd1576668415bab19a6050eb3dc4a3cc334224459c87bd7c035c7ab5c499e482496d6d65b73f5a5f76434dcbdffb756d436eadf3ded4e93d61c818590702efb38ac112cbdbd68a902b617df083d66171deea3a0ca6664333d9b9aaa439963ffc0ff117a4051de63ef40c2897bdcb1a4c737ca961c834ff131b8c2dcaf219ec9df4cc296550ad49569826ce9d14d694c397426987b4f96a12cfe8187856120beb89e61dc96381a7dfd0507d19bff12839302d533339db9dfdfccac64587fd6c6a985665e60e9b9c4f1b4a7e0511d56b989692b207ec97289c3a8e844014f90e37ede1043e3108013952209519cb7ccc79b03958636c8eae8e427789b0d33add90ddc2f236ca5753fdd9e8f3ef6da92fc7d495e73b089326beb4aa7b4f84cc7abcd882e0532d1b1fec730ee2704fc6573cc935ca253b0a40d1afced826767c95910bec5d3cf9f8f2023ae6fd785a633aeb642a68e70da9756fc0666de4886df9d274f53111b8b996b29b4af49118a861890b55bf617c6ee12b5fa082e842922ca6ca7aa6d1e50ff9daed230f050fa827d68d2029b54f2b57ffa9722da708912e4dcfdd5017bfa9dd9a8e7306069204695859fd4bd0b87835fdba379011cb6e587df7dba07bc87c7782f5f88316a28ef8f25ec8f3dc842b086cb3f6dd72d2e265718fcd3c1db387823e1f48d55f240b214ac8a9528e9fe94a9adaf1a250d677923f7ae7caa98259469bb30230c6cedfbd877dcb8255755f1b7edb59ce7e485b0ba89b890265f66c07874758920428687d704fdcac683c0b9fb5c081dc3147691c8bcda8d398d2df98e9c0baa0eefb9718518c5a935cb6f008ff2339d469c52121f87a27659fde07c87d2a193c058e240a22ef7c1