I'm pentesting a website and there is feature of uploading Nuget pkg, and it doesn't upload any other file then nuget and when we upload a nuget file then website will try to fetch url from the file, i read the docs of nuget and found that it uses xml format but i download some nuget packages from the web and it is encoded which starts with PK??, so i want to ask that are there any vulnerabilities in nuget packages or parser, i mean can i exploit this feature.

  • Hi @user8255299. It's not entirely clear what behavior you are experiencing with the application, what is getting uploaded (do you mean the .nupkg? The .nuspec?), or specifically what you've downloaded when you say you've downloaded a package. It sounds like you may have identified an SSRF vulnerablity, but to determine if there may be any others, we'll need more clarification. – user52472 Feb 26 at 21:31
  • hi @user8255299, sorry for late reply, actually i'm testing file upload functionality of website, and it only accepts file with .nupkg extension and i read the docs of nuget and found that it uses content-type: xml, so are there any chance of XXE or any other vulnerability here. when i try to upload any other file it shows error that cannot connect to the package feed. – user8255299 Mar 7 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.