Pre-auth XXE → HTTP SSRF on ArubaOS 8.13.2 closed as "theoretical / no valid PoC" despite TCP pcap, sshd localhost log, and internal port scan — documenting for community review
Source Reddit NetSec
Discussion
A pre-authentication XML External Entity (XXE) vulnerability leading to HTTP Server-Side Request Forgery (SSRF) was reported on ArubaOS 8.13.2, specifically on port 32000's default XML API which requires no authentication. The report includes evidence such as TCP packet captures, SSH localhost logs, and internal port scans via SSRF. Despite this evidence, the issue was closed by the vendor as theoretical with no valid proof of concept. The vulnerability details and proof of concept are publicly documented on GitHub for community review.
r/netsec (opens in a new tab)u/Pale_Surround_39240 points0 comments
Pre-auth XXE on ArubaOS 8.13.2 port 32000 (default-xml-api, no auth required).
Evidence: TCP pcap + sshd 127.0.0.1 log + 9 internal ports via SSRF.
Closed as "theoretical / no valid PoC." Full writeup + PoC + pcap on GitHub.