MoguBlog XML External Entity Injection in WeChat Callback

MoguBlog versions through 6.2 contain a critical XML external entity (XXE) injection vulnerability located within the WeChat callback handler. The flaw exists in the WechatRestApi.index() method, which improperly handles raw request bodies by passing them to the SignUtil.xmlToMap() function. This function utilizes a dom4j SAXReader without explicitly disabling Document Type Definition (DTD) processing or external entity expansion. Consequently, unauthenticated remote attackers can supply malicious XML payloads containing crafted DOCTYPE declarations to the /wechat/wechatCheck endpoint. Successful exploitation allows for the exfiltration of local system files, the execution of unauthorized outbound HTTP requests (SSRF), and potential reflection of resolved entities within application error messages. This vulnerability poses a significant risk to the confidentiality and integrity of the application server.

Attack Chain

1. The attacker crafts a malicious XML payload including a DOCTYPE declaration defining an external entity pointing to a local file (e.g., /etc/passwd) or a target URL.
2. The attacker sends a POST request targeting the /wechat/wechatCheck endpoint.
3. The WechatRestApi.index() method accepts the raw request body.
4. The application triggers the SignUtil.xmlToMap() method, which initiates a dom4j SAXReader to parse the incoming request.
5. The unhardened XML parser processes the malicious DOCTYPE, resolving the external entity.
6. The application includes the content of the external entity or the response from the SSRF request in the HTTP error response.
7. The attacker parses the returned data to view sensitive local files or capture the output of unauthorized outbound requests.

Impact

Successful exploitation of CVE-2026-89260 allows unauthenticated attackers to gain unauthorized access to sensitive files on the host filesystem and utilize the application as a proxy for server-side request forgery (SSRF) attacks. This can lead to the exposure of credentials, configuration files, or internal network mapping.

Recommendation

• Update MoguBlog to a patched version beyond 6.2 immediately upon availability from the vendor.
• Deploy the provided Sigma rule to detect POST requests to the /wechat/wechatCheck endpoint containing suspicious XML entity patterns.
• Configure the application server or WAF to inspect and block inbound HTTP requests containing !DOCTYPE or ENTITY tags when targeting the identified callback URL.