3 ms·
Just take the first example from wikipedia: <?xml version="1.0"?> <methodCall> <methodName>examples.getStateName</methodName> <params>
by user5994461 6y ago
Just take the first example from wikipedia:
<?xml version="1.0"?>
<methodCall>
<methodName>examples.getStateName</methodName>
<params>
<param>
<value><i4>40</i4></value>
</param>
</params>
</methodCall>
The thing is meant to call arbitrary functions with arbitrary arguments. It doesn't take long until there is a straight up exec functions exposed or some accidental command injection.
It's strange to look at it 20 years later. The adoption of JSON really got developers to stop shipping RCE vulnerabilities every other week. Yet nobody must have thought of that when deciding what to use.
- wvenable 6y agoWhat do you think happens with REST and JSON? Or SOAP? This is exactly identical to: { "methodName": example.getStateName "params": [14] } Although you'd probably instead have an REST endpoint contain the method name and the entire JSON body is the parameters. But the difference is minor. There's no reason this allows arbitrary execution than anything else. Methods directly exposed to the web is how 99% of all MVC frameworks work.