Posted by Nicolas Grégoire on Jan 11

Hello,

AMF (aka “Action Message Format”) is a binary format used by Flash
applications communicating with server-side components. A few data types
supported by AMF deal with XML content (for example the “XML Document”
type in AMF0).

In 2015, several AMF libraries (including BlazeDS and PyAMF) were
identified as vulnerable to XXE (aka “XML External Entity”) and SSRF
(aka “Server Side Forgery”) attacks. I…