When evaluating the security of XML based services, one should always consider DTD based attack vectors, such as XML External Entities (XXE) as,for example, our previous post XXE in SAML Interfaces demonstrates.
XML External Entities (XXE) คือ การใช้งานภาษา XML เวอร์ชันเก่าหรือการตั้งค่า XML ที่ไม่.
Generate a cheat sheet specific for the technologies your development team used.NET: Manual XML construction Razor (.cshtml/.vbhtml) Web Forms (.aspx) HTML Sanitization SQL - ADO.net SQL - LINQ OS Command LDAP Queries XPath XPath - MvpXml XML parsing (XXE) Java: Coming soon Javascript: Angular Ember.js DOMPurify PHP: Coming soon Python: Coming.
The OWASP XXE Cheat Sheet instructs users on how to configure security controls for the XML parsers that create JAXB sources to prevent XXE. The following table maps JAXB XML sources to the XML parser that must be configured explicitly with security controls.
In this post we provide a comprehensive list of different DTD attacks. The attacks are categorized as follows:
Your can also check out our large-scale parser evaluation against DTD attacks. Last updated on 16. January 2019. Please contact us if you have any missing vectors!
XMLmind XML Editor - Commands Hussein Shafie XMLmind Software Publication date March 5, 2021 Abstract This document contains the reference of all native XXE commands and explains how to write custom macro. XML External Entity Prevention Cheat Sheet¶ Introduction¶. XML eXternal Entity injection (XXE), which is now part of the OWASP Top 10 via the point A4, is a type of attack against an application that parses XML input. XXE issue is referenced under the ID 611 in the Common Weakness Enumeration referential. This attack occurs when untrusted XML input containing a reference to an external.
Testing for Entity Support
If this test is successful and and parsing process is slowed down, there is a high probability that your parser is configured insecurely and is vulnerable to at least one kind of DoS.
Billion Laughs Attack (Klein, 2002)
This file expands to about 30 KByte but has a total of 11111 entity references and therefore exceeds a reasonable threshold of entity references. Source
This vector is not well-formed by [WFC: No Recursion].
External General Entities (Steuck, 2002)
The idea of this attack is to declare an external general entity and reference a large file on a network resource or locally (e.g. C:/pagefile.sys or /dev/random). However, conducting DoS attacks in such a manner is only applicable by making the parser process a large XML document.
Source
Classic XXE Attack (Steuck, 2002)
We use the file '/sys/power/image_size' as an example, because it is a very simple file (one line, no special characters). This attack requires a direct feedback channel and reading out files is limited by 'forbidden characters in XML' such as '<' and '&'. If such characters occur in the accessed file (e.g. /etc/fstab) the XML parser raises an exception and stops the parsing of the message. Source
XXE Attack using netdoc
Source: @Nirgoldshlager
XXE Attack using UTF-16 (Dawid Golunski)
Some simple blacklisting countermeasures can probably bypassed by changing the default XML charset (which is UTF-8), to a different one, for example, UTF-16
The above file can be simply created with a texteditor. To convert it to UTF-16, you can use the linux tool iconv # cat file.xml | iconv -f UTF-8 -t UTF-16 > file_utf16.xml Source, Thanks to @ilmila
XXE Attack using UTF-7
The same trick can be applied to UTF-7 as-well.
# cat file.xml | iconv -f UTF-8 -t UTF-7 > file_utf7.xml Source, Thanks to @ilmila This class of attacks vectors is called evolved XXE attacks and is used to (i) bypass restrictions of classic XXE attacks and (ii) for Out-of-Band attacks.
Xxe Cheat Sheet Github
Bypassing Restrictions of XXE (Morgan, 2014)
File stored on http://publicServer.com/parameterEntity_core.dtd
Source
Bypassing Restrictions of XXE (Späth, 2015)
File stored on http://publicServer.com/parameterEntity_doctype.dtd
XXE by abusing Attribute Values (Yunusov, 2013)
This vector bypasses [WFC: No External Entity References].
File stored on http://publicServer.com/external_entity_attribute.dtd
Source
Error-based XXE using Parameter Entitites (Arseniy Sharoglazov, 2018)
Using the FTP protocol, an attacker can read out files of arbitrary length.
File stored on http://publicServer.com/parameterEntity_sendftp.dtd
This attack requires to setup a modified FTP server. However, adjustments to this PoC code are probably necessary to apply it to an arbitrary parser. Source
SchemaEntity Attack (Späth, 2015)
We identified three variations of this attack using (i) schemaLocation, (ii) noNamespaceSchemaLocation and (iii) XInclude.
Although it is best to reference a well-formed XML file (or any text file for that matter), in order not to cause an error, it is possible with some parsers to invoke an URL without referencing a not well-formed file. Source
File stored on http://publicServer.com/url_invocation_schemaLocation.xsd
Owasp Xxe Cheat Sheet
or use this file
noNamespaceSchemaLocation
Xxe Cheat Sheet
File stored on http://publicServer.com/url_invocation_noNamespaceSchemaLocation.xsd
If you pentest a web service that supports JSON, you can try to enforce it parsing XML as well.
The example is copied from this Blogpost by Antti Rantasaari.
Given HTTP example request:
It can be converted to enforce using XML by setting the HTTP Content-Type to application/xml:
In this case, the JSON parameters 'name' and 'value' are converted to XML elements '<search>' and '<value>' to be Schema conform to the JSON format.
A root element '<root>' was added around <search> and <value> to get a valid XML document (since an XML document must have exactly one root element).
The XXE attack might also work by simply adding one of the other attack vectors of this blog.
Source
Authors of this Post
Christopher Späth ChristianMainka (@CheariX) Vladislav Mladenov
What are XML External Entities (XXE)?
According to OWASP, “An XML External Entity attack is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.”
Applications and in particular XML-based web services or downstream integrations might be vulnerable to attack if:
The application accepts XML directly or XML uploads, especially from untrusted sources, or inserts untrusted data into XML documents, which is then parsed by an XML processor.
Any of the XML processors in the application or SOAP based web services has document type definitions (DTDs) enabled. As the exact mechanism for disabling DTD processing varies by processor, it is good practice to consult a reference such as the OWASP Cheat Sheet 'XXE Prevention’.
If your application uses SAML for identity processing within federated security or single sign on (SSO) purposes. SAML uses XML for identity assertions, and may be vulnerable.
If the application uses SOAP prior to version 1.2, it is likely susceptible to XXE attacks if XML entities are being passed to the SOAP framework.
Being vulnerable to XXE attacks likely means that the application is vulnerable to denial of service attacks including the Billion Laughs attack.
XXE Examples
Numerous public XXE issues have been discovered, including attacking embedded devices. XXE occurs in a lot of unexpected places, including deeply nested dependencies. The easiest way is to upload a malicious XML file, if accepted:
Example #1: The attacker attempts to extract data from the server
Example #2: An attacker probes the server's private network by changing the above ENTITY line to
Example #3: An attacker attempts a denial-of-service attack by including a potentially endless file