https://netacoding.com/tags/blind-xxe/ Recent content in Blind-XXE on Netacoding | Cybersecurity, Assembly & Network Research https://netacoding.com/img/logo-netacoding.png https://netacoding.com/img/logo-netacoding.png Hugo en-us Mon, 01 Jun 2026 00:00:00 +0000 https://netacoding.com/posts/xxe-ssrf/ Mon, 01 Jun 2026 00:00:00 +0000 https://netacoding.com/posts/xxe-ssrf/ ArubaOS 8.13.2.0 port 32000/TCP exposes an unauthenticated XML parser (default-xml-api AAA profile) that resolves SYSTEM external entities. Confirmed: OOB SSRF via wire-level pcap, internal port scan (9 ports confirmed open), attacker DTD fetch, and target sshd log showing 127.0.0.1-sourced HTTP request. CVSS 9.3 Critical. Bugcrowd closed as theoretical despite 4 independent evidence items.