XML External Entity (XXE) Prevention Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T14:30:00Z

Point to the official site

2019-02-16T16:57:20Z

Migration to GitHub of the project

2018-12-03T17:21:30Z

‎libxerces-c

2018-12-02T16:33:28Z

Add CWE ID reference

2018-12-02T16:30:26Z

Add syntax highlight code

2018-12-02T16:29:45Z

Refactor UI

2018-12-02T16:27:54Z

Oops is InfoSec that use the CS content, sorry...

2018-12-02T16:26:29Z

Add syntax highlight code

2018-12-02T16:25:32Z

Add infosecinstitute ref because this CS use many content from their article and this is not normal to not mention them!!!

2018-12-02T16:21:50Z

Add syntax highlight code

← Older revision		Revision as of 14:30, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.md XML External Entity (XXE) Prevention Cheat Sheet] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html XML External Entity (XXE) Prevention Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 76: / Line 76: @@
 <syntaxhighlight lang="c++">
-AX2XMLReader* reader = XMLReaderFactory::createXMLReader();
+SAX2XMLReader* reader = XMLReaderFactory::createXMLReader();
 parser->setFeature(XMLUni::fgXercesDisableDefaultEntityResolution, true);
 </syntaxhighlight>

← Older revision		Revision as of 16:33, 2 December 2018
Line 10:		Line 10:

	''XML eXternal Entity injection'' (XXE), which is now part of the [[Top_10-2017_A4-XML_External_Entities_(XXE)\| OWASP Top 10]], is a type of attack against an application that parses XML input.		''XML eXternal Entity injection'' (XXE), which is now part of the [[Top_10-2017_A4-XML_External_Entities_(XXE)\| OWASP Top 10]], is a type of attack against an application that parses XML input.
		+
		+	XXE issue is referenced under the ID [https://cwe.mitre.org/data/definitions/611.html 611] in the [https://cwe.mitre.org/index.html Common Weakness Enumeration] referential.

	This attack occurs when untrusted XML input containing a '''reference to an external entity is processed by a weakly configured XML parser'''.		This attack occurs when untrusted XML input containing a '''reference to an external entity is processed by a weakly configured XML parser'''.

@@ Line 33: / Line 33: @@
 The Enum [http://xmlsoft.org/html/libxml-parser.html#xmlParserOption xmlParserOption] should not have the following options defined:
-* XML_PARSE_NOENT: Expands entities and substitutes them with replacement text
+* <code>XML_PARSE_NOENT</code>: Expands entities and substitutes them with replacement text
-* XML_PARSE_DTDLOAD: Load the external DTD
+* <code>XML_PARSE_DTDLOAD</code>: Load the external DTD

@@ Line 9: / Line 9: @@
 = Introduction =
-<i>XML eXternal Entity</i> injection (XXE), which is now part of the [[Top_10-2017_A4-XML_External_Entities_(XXE)| OWASP Top 10]], is a type of attack against an application that parses XML input. This attack occurs when untrusted <b>XML input containing a reference to an external entity is processed by a weakly configured XML parser</b>. This attack may lead to the disclosure of confidential data, denial of service, [[Server Side Request Forgery]] (SSRF), port scanning from the perspective of the machine where the parser is located, and other system impacts. The following guide provides concise information to prevent this vulnerability. For more information on XXE, please visit [[XML External Entity (XXE) Processing]].
+''XML eXternal Entity injection'' (XXE), which is now part of the [[Top_10-2017_A4-XML_External_Entities_(XXE)| OWASP Top 10]], is a type of attack against an application that parses XML input.
 ==General Guidance==

@@ Line 512: / Line 512: @@
 ==References==
-* [https://resources.infosecinstitute.com/identify-mitigate-xxe-vulnerabilities/ XXE by InfoSecInstitute (heavily used in this Cheat Sheet,)]. Thanks to them!
+* [https://resources.infosecinstitute.com/identify-mitigate-xxe-vulnerabilities/ XXE by InfoSecInstitute]
 * [[Top_10-2017_A4-XML_External_Entities_(XXE)| OWASP Top 10-2017 A4: XML External Entities (XXE)]]
 * [https://vsecurity.com//download/papers/XMLDTDEntityAttacks.pdf Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks"]

@@ Line 505: / Line 505: @@
 Per [http://php.net/manual/en/function.libxml-disable-entity-loader.php the PHP documentation], the following should be set when using the default PHP XML parser in order to prevent XXE:
 libxml_disable_entity_loader(true);
 A description of how to abuse this in PHP is presented in a good [https://www.sensepost.com/blog/2014/revisting-xxe-and-abusing-protocols/ SensePost article] describing a cool PHP based XXE vulnerability that was fixed in Facebook.

@@ Line 483: / Line 483: @@
 ===libxml2===
-iOS includes the C/C++ libxml2 library described above, so that guidance applies if you are using libxml2 directly. However, the version of libxml2 provided up through iOS6 is prior to version 2.9 of libxml2 (which protects against XXE by default).
+iOS includes the C/C++ libxml2 library described above, so that guidance applies if you are using libxml2 directly.
 ===NSXMLDocument===
-iOS also provides an NSXMLDocument type, which is built on top of libxml2. However, NSXMLDocument provides some additional protections against XXE that aren't available in libxml2 directly. Per the 'NSXMLDocument External Entity Restriction API' section of: http://developer.apple.com/library/ios/#releasenotes/Foundation/RN-Foundation-iOS/Foundation_iOS5.html:
+iOS also provides an <code>NSXMLDocument</code> type, which is built on top of libxml2.
 * iOS4 and earlier: All external entities are loaded by default.
@@ Line 493: / Line 499: @@
 * iOS5 and later: Only entities that don't require network access are loaded. (which is safer)
-However, to completely disable XXE in an NSXMLDocument in any version of iOS you simply specify NSXMLNodeLoadExternalEntitiesNever when creating the NSXMLDocument.
+However, to completely disable XXE in an <code>NSXMLDocument</code> in any version of iOS you simply specify <code>NSXMLNodeLoadExternalEntitiesNever</code> when creating the <code>NSXMLDocument</code>.
 ==PHP==