WeChat Pay official urgently pushes tips on repairing XXE vulnerabilities, attached
Yesterday, a piece of news about WeChat Pay’s 0 yuan purchase went viral in the development circle. The so-called 0 yuan purchase is not a lottery for users, but a malicious attacker using a loophole to achieve 0 yuan payment.
The normal basic payment process is as follows: the user initiates payment -> calls up WeChat payment -> payment is successful -> the WeChat payment server sends a successful notification to the application (such as a mall) server -> the application server parses the notification sent by WeChat payment -> the parsed information performs necessary comparison and confirmation and updates the order to paid status.
However, this vulnerability is a malicious use of the parsing process, which can cause problems such as reading any file, intranet detection, and command execution.