SOAP Injection

Exploiting SOAP Injection for Privilege/Status Spoofing

This guide demonstrates how to exploit the SOAP Injection vulnerability in the "Check User Status" feature within the Admin Area.

Vulnerability Overview

The application uses a legacy SOAP service (/dvwsuserservice) to retrieve user details. The backend constructs the SOAP XML response by concatenating the requested username directly into the XML structure without proper escaping.

This allows an attacker to "break out" of the <username> tag and inject their own XML tags into the response, such as <role> or <status>.

Attack Scenario

An attacker wants to trick an administrator (or a system consuming this service) into believing a regular user has "admin" privileges.

Target Endpoint

• URL: /dvwsuserservice (Accessed via Admin Area -> Check User Status)
• Method: POST (XML)

Malicious Payload

The goal is to inject a <role>admin</role> tag. We use the following payload as the "Username":

test</username><role>admin</role><username>ignore

How it works:

1. The server expects to insert the username here: <username> [INPUT] </username>
2. With our input, it becomes: <username>test</username><role>admin</role><username>ignore</username>
3. The XML parser reads this as:
   • username: "test"
   • role: "admin" (The injected value!)
   • username: "ignore" (Extra tag to balance the structure)
   • ... followed by the real <role>user</role> which comes later in the template.

Since the injected tag appears first or is parsed as a sibling, the client application (Admin Dashboard) picks up the injected role.

Steps to Reproduce

1. Log in to the application (as admin/vulntest).
2. Navigate to the Admin Area (admin.html).
3. Locate the "Check User Status (SOAP Service)" section.
4. In the "Enter Username" field, paste the payload: test</username><role>admin</role><username>ignore (Note: You might need to URL-encode characters if sending via raw API, but the form handles it).
5. Click Check.
6. Result: The result area should display:
   • Username: test
   • Role: admin (Spoofed!)
   • Status: active

You have successfully injected a tag into the SOAP response and spoofed the user's role.