|
|
| (One intermediate revision by the same user not shown) |
| Line 2: |
Line 2: |
| | <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div> | | <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div> |
| | | | |
| − | {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| + | The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]! |
| − | | valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
| |
| − | Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
| |
| − | <br />
| |
| − | __TOC__{{TOC hidden}}
| |
| − | = Introduction =
| |
| | | | |
| − | ''XML eXternal Entity injection'' (XXE), which is now part of the [[Top_10-2017_A4-XML_External_Entities_(XXE)| OWASP Top 10]], is a type of attack against an application that parses XML input.
| + | Please visit [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html XML External Entity (XXE) Prevention Cheat Sheet] to see the latest version of the cheat sheet. |
| − | | |
| − | XXE issue is referenced under the ID [https://cwe.mitre.org/data/definitions/611.html 611] in the [https://cwe.mitre.org/index.html Common Weakness Enumeration] referential.
| |
| − | | |
| − | This attack occurs when untrusted XML input containing a '''reference to an external entity is processed by a weakly configured XML parser'''.
| |
| − | | |
| − | This attack may lead to the disclosure of confidential data, denial of service, [[Server Side Request Forgery]] (SSRF), port scanning from the perspective of the machine where the parser is located, and other system impacts. The following guide provides concise information to prevent this vulnerability.
| |
| − | | |
| − | For more information on XXE, please visit [[XML External Entity (XXE) Processing]].
| |
| − | | |
| − | ==General Guidance==
| |
| − | The safest way to prevent XXE is always to disable DTDs (External Entities) completely. Depending on the parser, the method should be similar to the following:
| |
| − | <syntaxhighlight lang="java">
| |
| − | factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | Disabling DTDs also makes the parser secure against denial of services (DOS) attacks such as Billion Laughs. If it is not possible to disable DTDs completely, then external entities and external document type declarations must be disabled in the way that’s specific to each parser.
| |
| − | | |
| − | Detailed XXE Prevention guidance for a number of languages and commonly used XML parsers in those languages is provided below.
| |
| − | | |
| − | ==C/C++==
| |
| − | | |
| − | ===libxml2===
| |
| − | | |
| − | The Enum [http://xmlsoft.org/html/libxml-parser.html#xmlParserOption xmlParserOption] should not have the following options defined:
| |
| − | | |
| − | * <code>XML_PARSE_NOENT</code>: Expands entities and substitutes them with replacement text
| |
| − | * <code>XML_PARSE_DTDLOAD</code>: Load the external DTD
| |
| − | | |
| − | | |
| − | Note:
| |
| − | | |
| − | Per: https://mail.gnome.org/archives/xml/2012-October/msg00045.html, starting with libxml2 version 2.9, XXE has been disabled by default as committed by the following patch: http://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f.
| |
| − | | |
| − | | |
| − | Search for the usage of the following APIs to ensure there is no <code>XML_PARSE_NOENT</code> and <code>XML_PARSE_DTDLOAD</code> defined in the parameters:
| |
| − | * xmlCtxtReadDoc
| |
| − | * xmlCtxtReadFd
| |
| − | * xmlCtxtReadFile
| |
| − | * xmlCtxtReadIO
| |
| − | * xmlCtxtReadMemory
| |
| − | * xmlCtxtUseOptions
| |
| − | * xmlParseInNodeContext
| |
| − | * xmlReadDoc
| |
| − | * xmlReadFd
| |
| − | * xmlReadFile
| |
| − | * xmlReadIO
| |
| − | * xmlReadMemory
| |
| − | | |
| − | ===libxerces-c===
| |
| − | Use of XercesDOMParser do this to prevent XXE:
| |
| − | | |
| − | <syntaxhighlight lang="c++">
| |
| − | XercesDOMParser *parser = new XercesDOMParser;
| |
| − | parser->setCreateEntityReferenceNodes(false);
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | Use of SAXParser, do this to prevent XXE:
| |
| − | | |
| − | <syntaxhighlight lang="c++">
| |
| − | SAXParser* parser = new SAXParser;
| |
| − | parser->setDisableDefaultEntityResolution(true);
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | Use of SAX2XMLReader, do this to prevent XXE:
| |
| − | | |
| − | <syntaxhighlight lang="c++">
| |
| − | SAX2XMLReader* reader = XMLReaderFactory::createXMLReader();
| |
| − | parser->setFeature(XMLUni::fgXercesDisableDefaultEntityResolution, true);
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | ==Java==
| |
| − | | |
| − | Java applications using XML libraries are particularly vulnerable to XXE because the default settings for most Java XML parsers is to have XXE enabled. To use these parsers safely, you have to explicitly disable XXE in the parser you use. The following describes how to disable XXE in the most commonly used XML parsers for Java.
| |
| − | | |
| − | ===JAXP DocumentBuilderFactory, SAXParserFactory and DOM4J===
| |
| − | | |
| − | <code>DocumentBuilderFactory, SAXParserFactory</code> and <code>DOM4J XML</code> Parsers can be configured using the same techniques to protect them against XXE.
| |
| − | | |
| − | Only the <code>DocumentBuilderFactory</code> example is presented here. The JAXP <code>DocumentBuilderFactory</code> [http://docs.oracle.com/javase/7/docs/api/javax/xml/parsers/DocumentBuilderFactory.html#setFeature(java.lang.String,%20boolean) setFeature] method allows a developer to control which implementation-specific XML processor features are enabled or disabled.
| |
| − | | |
| − | The features can either be set on the factory or the underlying <code>XMLReader</code> [http://docs.oracle.com/javase/7/docs/api/org/xml/sax/XMLReader.html#setFeature%28java.lang.String,%20boolean%29 setFeature] method.
| |
| − | | |
| − | Each XML processor implementation has its own features that govern how DTDs and external entities are processed.
| |
| − | | |
| − | For a syntax highlighted example code snippet using <code>SAXParserFactory</code>, look [https://gist.github.com/asudhakar02/45e2e6fd8bcdfb4bc3b2 here].
| |
| − | | |
| − | <syntaxhighlight lang="java">
| |
| − | import javax.xml.parsers.DocumentBuilderFactory;
| |
| − | import javax.xml.parsers.ParserConfigurationException; // catching unsupported features
| |
| − | | |
| − | ...
| |
| − | | |
| − | DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
| |
| − | String FEATURE = null;
| |
| − | try {
| |
| − | // This is the PRIMARY defense. If DTDs (doctypes) are disallowed, almost all XML entity attacks are prevented
| |
| − | // Xerces 2 only - http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl
| |
| − | FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
| |
| − | dbf.setFeature(FEATURE, true);
| |
| − | | |
| − | // If you can't completely disable DTDs, then at least do the following:
| |
| − | // Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-general-entities
| |
| − | // Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-general-entities
| |
| − | // JDK7+ - http://xml.org/sax/features/external-general-entities
| |
| − | FEATURE = "http://xml.org/sax/features/external-general-entities";
| |
| − | dbf.setFeature(FEATURE, false);
| |
| − | | |
| − | // Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-parameter-entities
| |
| − | // Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities
| |
| − | // JDK7+ - http://xml.org/sax/features/external-parameter-entities
| |
| − | FEATURE = "http://xml.org/sax/features/external-parameter-entities";
| |
| − | dbf.setFeature(FEATURE, false);
| |
| − | | |
| − | // Disable external DTDs as well
| |
| − | FEATURE = "http://apache.org/xml/features/nonvalidating/load-external-dtd";
| |
| − | dbf.setFeature(FEATURE, false);
| |
| − | | |
| − | // and these as well, per Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks"
| |
| − | dbf.setXIncludeAware(false);
| |
| − | dbf.setExpandEntityReferences(false);
| |
| − | | |
| − | // And, per Timothy Morgan: "If for some reason support for inline DOCTYPEs are a requirement, then
| |
| − | // ensure the entity settings are disabled (as shown above) and beware that SSRF attacks
| |
| − | // (http://cwe.mitre.org/data/definitions/918.html) and denial
| |
| − | // of service attacks (such as billion laughs or decompression bombs via "jar:") are a risk."
| |
| − | | |
| − | // remaining parser logic
| |
| − | ...
| |
| − | } catch (ParserConfigurationException e) {
| |
| − | // This should catch a failed setFeature feature
| |
| − | logger.info("ParserConfigurationException was thrown. The feature '" + FEATURE + "' is probably not supported by your XML processor.");
| |
| − | ...
| |
| − | } catch (SAXException e) {
| |
| − | // On Apache, this should be thrown when disallowing DOCTYPE
| |
| − | logger.warning("A DOCTYPE was passed into the XML document");
| |
| − | ...
| |
| − | } catch (IOException e) {
| |
| − | // XXE that points to a file that doesn't exist
| |
| − | logger.error("IOException occurred, XXE may still possible: " + e.getMessage());
| |
| − | ...
| |
| − | }
| |
| − | | |
| − | // Load XML file or stream using a XXE agnostic configured parser...
| |
| − | DocumentBuilder safebuilder = dbf.newDocumentBuilder();
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | [http://xerces.apache.org/xerces-j/ Xerces 1] [http://xerces.apache.org/xerces-j/features.html Features]:
| |
| − | * Do not include external entities by setting [http://xerces.apache.org/xerces-j/features.html#external-general-entities this feature] to <code>false</code>.
| |
| − | * Do not include parameter entities by setting [http://xerces.apache.org/xerces-j/features.html#external-parameter-entities this feature] to <code>false</code>.
| |
| − | * Do not include external DTDs by setting [http://xerces.apache.org/xerces-j/features.html#load-external-dtd this feature] to <code>false</code>.
| |
| − | | |
| − | [http://xerces.apache.org/xerces2-j/ Xerces 2] [http://xerces.apache.org/xerces2-j/features.html Features]:
| |
| − | * Disallow an inline DTD by setting [http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl this feature] to <code>true</code>.
| |
| − | * Do not include external entities by setting [http://xerces.apache.org/xerces2-j/features.html#external-general-entities this feature] to <code>false</code>.
| |
| − | * Do not include parameter entities by setting [http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities this feature] to <code>false</code>.
| |
| − | * Do not include external DTDs by setting [http://xerces.apache.org/xerces-j/features.html#load-external-dtd this feature] to <code>false</code>.
| |
| − | | |
| − | '''Note: The above defenses require Java 7 update 67, Java 8 update 20, or above, because the above countermeasures for DocumentBuilderFactory and SAXParserFactory are broken in earlier Java versions, per: [http://www.cvedetails.com/cve/CVE-2014-6517/ CVE-2014-6517].'''
| |
| − | | |
| − | ===XMLInputFactory (a StAX parser)===
| |
| − | | |
| − | [http://en.wikipedia.org/wiki/StAX StAX] parsers such as <code>[http://docs.oracle.com/javase/7/docs/api/javax/xml/stream/XMLInputFactory.html XMLInputFactory]</code> allow various properties and features to be set.
| |
| − | | |
| − | To protect a Java <code>XMLInputFactory</code> from XXE, do this:
| |
| − | | |
| − | <syntaxhighlight lang="java">
| |
| − | xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); // This disables DTDs entirely for that factory
| |
| − | xmlInputFactory.setProperty("javax.xml.stream.isSupportingExternalEntities", false); // disable external entities
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | ===TransformerFactory===
| |
| − | To protect a <code>javax.xml.transform.TransformerFactory</code> from XXE, do this:
| |
| − | | |
| − | <syntaxhighlight lang="java">
| |
| − | TransformerFactory tf = TransformerFactory.newInstance();
| |
| − | tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
| |
| − | tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | ===Validator===
| |
| − | To protect a <code>javax.xml.validation.Validator</code> from XXE, do this:
| |
| − | | |
| − | <syntaxhighlight lang="java">
| |
| − | SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
| |
| − | Schema schema = factory.newSchema();
| |
| − | Validator validator = schema.newValidator();
| |
| − | validator.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
| |
| − | validator.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | ===SchemaFactory===
| |
| − | To protect a <code>javax.xml.validation.SchemaFactory</code> from XXE, do this:
| |
| − | | |
| − | <syntaxhighlight lang="java">
| |
| − | SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
| |
| − | factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
| |
| − | factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
| |
| − | Schema schema = factory.newSchema(Source);
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | ===SAXTransformerFactory===
| |
| − | To protect a <code>javax.xml.transform.sax.SAXTransformerFactory</code> from XXE, do this:
| |
| − | | |
| − | <syntaxhighlight lang="java">
| |
| − | SAXTransformerFactory sf = SAXTransformerFactory.newInstance();
| |
| − | sf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
| |
| − | sf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
| |
| − | sf.newXMLFilter(Source);
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | '''Note: Use of the following <code>XMLConstants</code> requires JAXP 1.5, which was added to Java in 7u40 and Java 8:'''
| |
| − | * javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD
| |
| − | * javax.xml.XMLConstants.ACCESS_EXTERNAL_SCHEMA
| |
| − | * javax.xml.XMLConstants.ACCESS_EXTERNAL_STYLESHEET
| |
| − | | |
| − | ===XMLReader===
| |
| − | To protect a Java <code>org.xml.sax.XMLReader</code> from XXE, do this:
| |
| − | | |
| − | <syntaxhighlight lang="java">
| |
| − | XMLReader reader = XMLReaderFactory.createXMLReader();
| |
| − | reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
| |
| − | reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); // This may not be strictly required as DTDs shouldn't be allowed at all, per previous line.
| |
| − | reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
| |
| − | reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | ===SAXReader===
| |
| − | To protect a Java <code>org.dom4j.io.SAXReader</code> from XXE, do this:
| |
| − | | |
| − | <syntaxhighlight lang="java">
| |
| − | saxReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
| |
| − | saxReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
| |
| − | saxReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | Based on testing, if you are missing one of these, you can still be vulnerable to an XXE attack.
| |
| − | | |
| − | ===SAXBuilder===
| |
| − | To protect a Java <code>org.jdom2.input.SAXBuilder</code> from XXE, do this:
| |
| − | | |
| − | <syntaxhighlight lang="java">
| |
| − | SAXBuilder builder = new SAXBuilder();
| |
| − | builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl",true);
| |
| − | builder.setFeature("http://xml.org/sax/features/external-general-entities", false);
| |
| − | builder.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
| |
| − | Document doc = builder.build(new File(fileName));
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | ===JAXB Unmarshaller===
| |
| − | Since a <code>javax.xml.bind.Unmarshaller</code> parses XML and does not support any flags for disabling XXE, it’s imperative to parse the untrusted XML through a configurable secure parser first, generate a source object as a result, and pass the source object to the Unmarshaller. For example:
| |
| − | | |
| − | <syntaxhighlight lang="java">
| |
| − | //Disable XXE
| |
| − | SAXParserFactory spf = SAXParserFactory.newInstance();
| |
| − | spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
| |
| − | spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
| |
| − | spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
| |
| − | | |
| − | //Do unmarshall operation
| |
| − | Source xmlSource = new SAXSource(spf.newSAXParser().getXMLReader(), new InputSource(new StringReader(xml)));
| |
| − | JAXBContext jc = JAXBContext.newInstance(Object.class);
| |
| − | Unmarshaller um = jc.createUnmarshaller();
| |
| − | um.unmarshal(xmlSource);
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | ===XPathExpression===
| |
| − | A <code>javax.xml.xpath.XPathExpression</code> is similar to an Unmarshaller where it can’t be configured securely by itself, so the untrusted data must be parsed through another securable XML parser first.
| |
| − | | |
| − | For example:
| |
| − | | |
| − | <syntaxhighlight lang="java">
| |
| − | DocumentBuilderFactory df = DocumentBuilderFactory.newInstance();
| |
| − | df.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
| |
| − | df.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
| |
| − | DocumentBuilder builder = df.newDocumentBuilder();
| |
| − | String result = new XPathExpression().evaluate( builder.parse(new ByteArrayInputStream(xml.getBytes())) );
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | ===java.beans.XMLDecoder===
| |
| − | | |
| − | The [https://docs.oracle.com/javase/8/docs/api/java/beans/XMLDecoder.html#readObject-- readObject()] method in this class is fundamentally unsafe.
| |
| − | | |
| − | Not only is the XML it parses subject to XXE, but the method can be used to construct any Java object, and [http://stackoverflow.com/questions/14307442/is-it-safe-to-use-xmldecoder-to-read-document-files execute arbitrary code as described here].
| |
| − | | |
| − | And there is no way to make use of this class safe except to trust or properly validate the input being passed into it.
| |
| − | | |
| − | As such, we'd strongly recommend completely avoiding the use of this class and replacing it with a safe or properly configured XML parser as described elsewhere in this cheat sheet.
| |
| − | | |
| − | ===Other XML Parsers===
| |
| − | There are many 3rd party libraries that parse XML either directly or through their use of other libraries. Please test and verify their XML parser is secure against XXE by default. If the parser is not secure by default, look for flags supported by the parser to disable all possible external resource inclusions like the examples given above. If there’s no control exposed to the outside, make sure the untrusted content is passed through a secure parser first and then passed to insecure 3rd party parser similar to how the Unmarshaller is secured.
| |
| − | | |
| − | ==== Spring Framework MVC/OXM XXE Vulnerabilities ====
| |
| − | | |
| − | For example, some XXE vulnerabilities were found in [http://pivotal.io/security/cve-2013-4152 Spring OXM] and [http://pivotal.io/security/cve-2013-7315 Spring MVC]. The following versions of the Spring Framework are vulnerable to XXE:
| |
| − | | |
| − | * 3.0.0 to 3.2.3 (Spring OXM & Spring MVC)
| |
| − | * 4.0.0.M1 (Spring OXM)
| |
| − | * 4.0.0.M1-4.0.0.M2 (Spring MVC)
| |
| − | | |
| − | There were other issues as well that were fixed later, so to fully address these issues, Spring recommends you upgrade to Spring Framework 3.2.8+ or 4.0.2+.
| |
| − | | |
| − | For Spring OXM, this is referring to the use of org.springframework.oxm.jaxb.Jaxb2Marshaller. Note that the CVE for Spring OXM specifically indicates that 2 XML parsing situations are up to the developer to get right, and 2 are the responsibility of Spring and were fixed to address this CVE. Here's what they say:
| |
| − | | |
| − | '''Two situations developers must handle:'''
| |
| − | For a DOMSource, the XML has already been parsed by user code and that code is responsible for protecting against XXE.
| |
| − | For a StAXSource, the XMLStreamReader has already been created by user code and that code is responsible for protecting against XXE.
| |
| − | | |
| − | '''The issue Spring fixed:'''
| |
| − |
| |
| − | For SAXSource and StreamSource instances, Spring processed external entities by default thereby creating this vulnerability.
| |
| − | Here's an example of using a StreamSource that was vulnerable, but is now safe, if you are using a fixed version of Spring OXM or Spring MVC:
| |
| − |
| |
| − | org.springframework.oxm.Jaxb2Marshaller marshaller = new org.springframework.oxm.jaxb.Jaxb2Marshaller();
| |
| − | marshaller.unmarshal(new StreamSource(new StringReader(some_string_containing_XML)); // Must cast return Object to whatever type you are unmarshalling
| |
| − | | |
| − | So, per the [http://pivotal.io/security/cve-2013-4152 Spring OXM CVE writeup], the above is now safe. But if you were to use a DOMSource or StAXSource instead, it would be up to you to configure those sources to be safe from XXE.
| |
| − | | |
| − | ==.NET==
| |
| − | | |
| − | The following information for XXE injection in .NET is directly from this web application of unit tests by Dean Fleming: https://github.com/deanf1/dotnet-security-unit-tests.
| |
| − | | |
| − | This web application covers all currently supported .NET XML parsers, and has test cases for each demonstrating when they are safe from XXE injection and when they are not.
| |
| − | | |
| − | Previously, this information was based on James Jardine's excellent .NET XXE article: https://www.jardinesoftware.net/2016/05/26/xxe-and-net/.
| |
| − | | |
| − | | |
| − | It originally provided more recent and more detailed information than the older article from Microsoft on how to prevent XXE and XML Denial of Service in .NET: http://msdn.microsoft.com/en-us/magazine/ee335713.aspx, however, it has some inaccuracies that the web application covers.
| |
| − | | |
| − | The following table lists all supported .NET XML parsers and their default safety levels:
| |
| − | | |
| − | {| style="width: 25%; align:center; text-align:left; border: 2px solid #4d953d; background-color:#F2F2F2; padding=2;"
| |
| − | |- style="background-color: #4d953d; color: #FFFFFF;"
| |
| − | ! XML Parser !! Safe by Default?
| |
| − | |- style="background-color: #FFFFFF;"
| |
| − | |'''LINQ to XML'''
| |
| − | |Yes
| |
| − | |- style="background-color: #FFFFFF;"
| |
| − | |'''XmlDictionaryReader'''
| |
| − | |Yes
| |
| − | |- style="background-color: #FFFFFF;"
| |
| − | |'''XmlDocument'''
| |
| − | |
| |
| − | |-
| |
| − | |...prior to 4.5.2
| |
| − | |No
| |
| − | |-
| |
| − | |...in versions 4.5.2 +
| |
| − | |Yes
| |
| − | |- style="background-color: #FFFFFF;"
| |
| − | | '''XmlNodeReader'''
| |
| − | | Yes
| |
| − | |- style="background-color: #FFFFFF;"
| |
| − | | '''XmlReader'''
| |
| − | | Yes
| |
| − | |- style="background-color: #FFFFFF;"
| |
| − | | '''XmlTextReader'''
| |
| − | |
| |
| − | |-
| |
| − | | ...prior to 4.5.2
| |
| − | | No
| |
| − | |-
| |
| − | |...in versions 4.5.2 +
| |
| − | |Yes
| |
| − | |- style="background-color: #FFFFFF;"
| |
| − | | '''XPathNavigator'''
| |
| − | |
| |
| − | |-
| |
| − | |...prior to 4.5.2
| |
| − | |No
| |
| − | |-
| |
| − | |...in versions 4.5.2 +
| |
| − | |Yes
| |
| − | |- style="background-color: #FFFFFF;"
| |
| − | | '''XslCompiledTransform'''
| |
| − | | Yes
| |
| − | |}
| |
| − | | |
| − | === LINQ to XML ===
| |
| − | Both the <code>XElement</code> and <code>XDocument</code> objects in the <code>System.Xml.Linq</code> library are safe from XXE injection by default. <code>XElement</code> parses only the elements within the XML file, so DTDs are ignored altogether. <code>XDocument</code> has DTDs [https://github.com/dotnet/docs/blob/master/docs/visual-basic/programming-guide/concepts/linq/linq-to-xml-security.md disabled by default], and is only unsafe if constructed with a different unsafe XML parser.
| |
| − | | |
| − | === XmlDictionaryReader ===
| |
| − | <code>System.Xml.XmlDictionaryReader</code> is safe by default, as when it attempts to parse the DTD, the compiler throws an exception saying that "CData elements not valid at top level of an XML document". It becomes unsafe if constructed with a different unsafe XML parser.
| |
| − | | |
| − | === XmlDocument ===
| |
| − | Prior to .NET Framework version 4.5.2, <code>System.Xml.XmlDocument</code> is '''unsafe''' by default. The <code>XmlDocument</code> object has an <code>XmlResolver</code> object within it that needs to be set to null in versions prior to 4.5.2. In versions 4.5.2 and up, this <code>XmlResolver</code> is set to null by default.
| |
| − | | |
| − | The following example shows how it is made safe:
| |
| − | | |
| − | <syntaxhighlight lang="c#">
| |
| − | static void LoadXML()
| |
| − | {
| |
| − | string xml = "<?xml version=\"1.0\" ?><!DOCTYPE doc
| |
| − | [<!ENTITY win SYSTEM \"file:///C:/Users/user/Documents/testdata2.txt\">]
| |
| − | ><doc>&win;</doc>";
| |
| − |
| |
| − | XmlDocument xmlDoc = new XmlDocument();
| |
| − | xmlDoc.XmlResolver = null; // Setting this to NULL disables DTDs - Its NOT null by default.
| |
| − | xmlDoc.LoadXml(xml);
| |
| − | Console.WriteLine(xmlDoc.InnerText);
| |
| − | Console.ReadLine();
| |
| − | }
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | <code>XmlDocument</code> can become unsafe if you create your own nonnull <code>XmlResolver</code> with default or unsafe settings. If you need to enable DTD processing, instructions on how to do so safely are described in detail in the [http://msdn.microsoft.com/en-us/magazine/ee335713.aspx referenced MSDN article].
| |
| − | | |
| − | === XmlNodeReader ===
| |
| − | <code>System.Xml.XmlNodeReader</code> objects are safe by default and will ignore DTDs even when constructed with an unsafe parser or wrapped in another unsafe parser.
| |
| − | | |
| − | === XmlReader ===
| |
| − | <code>System.Xml.XmlReader</code> objects are safe by default.
| |
| − | | |
| − | They are set by default to have their ProhibitDtd property set to false in .NET Framework versions 4.0 and earlier, or their <code>DtdProcessing</code> property set to Prohibit in .NET versions 4.0 and later.
| |
| − | | |
| − | Additionally, in .NET versions 4.5.2 and later, the <code>XmlReaderSettings</code> belonging to the <code>XmlReader</code> has its <code>XmlResolver</code> set to null by default, which provides an additional layer of safety.
| |
| − | | |
| − | Therefore, <code>XmlReader</code> objects will only become unsafe in version 4.5.2 and up if both the <code>DtdProcessing</code> property is set to Parse and the <code>XmlReaderSetting</code>'s <code>XmlResolver</code> is set to a nonnull XmlResolver with default or unsafe settings. If you need to enable DTD processing, instructions on how to do so safely are described in detail in the [http://msdn.microsoft.com/en-us/magazine/ee335713.aspx referenced MSDN article].
| |
| − | | |
| − | === XmlTextReader ===
| |
| − | <code>System.Xml.XmlTextReader</code> is '''unsafe''' by default in .NET Framework versions prior to 4.5.2. Here is how to make it safe in various .NET versions:
| |
| − | | |
| − | ==== Prior to .NET 4.0 ====
| |
| − | In .NET Framework versions prior to 4.0, DTD parsing behavior for <code>XmlReader</code> objects like <code>XmlTextReader</code> are controlled by the Boolean <code>ProhibitDtd</code> property found in the <code>System.Xml.XmlReaderSettings</code> and <code>System.Xml.XmlTextReader</code> classes.
| |
| − | | |
| − | Set these values to true to disable inline DTDs completely.
| |
| − | | |
| − | <syntaxhighlight lang="c#">
| |
| − | XmlTextReader reader = new XmlTextReader(stream);
| |
| − | reader.ProhibitDtd = true; // NEEDED because the default is FALSE!!
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | ==== .NET 4.0 - .NET 4.5.2 ====
| |
| − | | |
| − | In .NET Framework version 4.0, DTD parsing behavior has been changed. The <code>ProhibitDtd</code> property has been deprecated in favor of the new <code>DtdProcessing</code> property.
| |
| − | | |
| − | However, they didn't change the default settings so <code>XmlTextReader</code> is still vulnerable to XXE by default.
| |
| − | | |
| − | Setting <code>DtdProcessing</code> to <code>Prohibit</code> causes the runtime to throw an exception if a <code><!DOCTYPE></code> element is present in the XML.
| |
| − | | |
| − | To set this value yourself, it looks like this:
| |
| − | | |
| − | <syntaxhighlight lang="c#">
| |
| − | XmlTextReader reader = new XmlTextReader(stream);
| |
| − | reader.DtdProcessing = DtdProcessing.Prohibit; // NEEDED because the default is Parse!!
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | Alternatively, you can set the <code>DtdProcessing</code> property to <code>Ignore</code>, which will not throw an exception on encountering a <code><!DOCTYPE></code> element but will simply skip over it and not process it. Finally, you can set <code>DtdProcessing</code> to <code>Parse</code> if you do want to allow and process inline DTDs.
| |
| − | | |
| − | ==== .NET 4.5.2 and later ====
| |
| − | | |
| − | In .NET Framework versions 4.5.2 and up, <code>XmlTextReader</code>'s internal <code>XmlResolver</code> is set to null by default, making the <code>XmlTextReader</code> ignore DTDs by default. The <code>XmlTextReader</code> can become unsafe if if you create your own nonnull <code>XmlResolver</code> with default or unsafe settings.
| |
| − | | |
| − | === XPathNavigator ===
| |
| − | | |
| − | <code>System.Xml.XPath.XPathNavigator</code> is '''unsafe''' by default in .NET Framework versions prior to 4.5.2.
| |
| − | | |
| − | This is due to the fact that it implements <code>IXPathNavigable</code> objects like <code>XmlDocument</code>, which are also unsafe by default in versions prior to 4.5.2.
| |
| − | | |
| − | You can make <code>XPathNavigator</code> safe by giving it a safe parser like <code>XmlReader</code> (which is safe by default) in the <code>XPathDocument</code>'s constructor.
| |
| − | | |
| − | Here is an example:
| |
| − | | |
| − | <syntaxhighlight lang="c#">
| |
| − | XmlReader reader = XmlReader.Create("example.xml");
| |
| − | XPathDocument doc = new XPathDocument(reader);
| |
| − | XPathNavigator nav = doc.CreateNavigator();
| |
| − | string xml = nav.InnerXml.ToString();
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | === XslCompiledTransform ===
| |
| − | <code>System.Xml.Xsl.XslCompiledTransform</code> (an XML transformer) is safe by default as long as the parser it’s given is safe.
| |
| − | | |
| − | It is safe by default because the default parser of the <code>Transform()</code> methods is an <code>XmlReader</code>, which is safe by default (per above).
| |
| − | | |
| − | [http://www.dotnetframework.org/default.aspx/4@0/4@0/DEVDIV_TFS/Dev10/Releases/RTMRel/ndp/fx/src/Xml/System/Xml/Xslt/XslCompiledTransform@cs/1305376/XslCompiledTransform@cs The source code for this method is here.]
| |
| − | | |
| − | Some of the <code>Transform()</code> methods accept an <code>XmlReader</code> or <code>IXPathNavigable</code> (e.g., <code>XmlDocument</code>) as an input, and if you pass in an unsafe XML Parser then the <code>Transform</code> will also be unsafe.
| |
| − | | |
| − | ==iOS==
| |
| − | | |
| − | ===libxml2===
| |
| − | | |
| − | iOS includes the C/C++ libxml2 library described above, so that guidance applies if you are using libxml2 directly.
| |
| − | | |
| − | However, the version of libxml2 provided up through iOS6 is prior to version 2.9 of libxml2 (which protects against XXE by default).
| |
| − | | |
| − | ===NSXMLDocument===
| |
| − | | |
| − | iOS also provides an <code>NSXMLDocument</code> type, which is built on top of libxml2.
| |
| − | | |
| − | However, <code>NSXMLDocument</code> provides some additional protections against XXE that aren't available in libxml2 directly.
| |
| − | | |
| − | Per the 'NSXMLDocument External Entity Restriction API' section of: http://developer.apple.com/library/ios/#releasenotes/Foundation/RN-Foundation-iOS/Foundation_iOS5.html:
| |
| − | | |
| − | * iOS4 and earlier: All external entities are loaded by default.
| |
| − | | |
| − | * iOS5 and later: Only entities that don't require network access are loaded. (which is safer)
| |
| − | | |
| − | However, to completely disable XXE in an <code>NSXMLDocument</code> in any version of iOS you simply specify <code>NSXMLNodeLoadExternalEntitiesNever</code> when creating the <code>NSXMLDocument</code>.
| |
| − | | |
| − | ==PHP==
| |
| − | | |
| − | Per [http://php.net/manual/en/function.libxml-disable-entity-loader.php the PHP documentation], the following should be set when using the default PHP XML parser in order to prevent XXE:
| |
| − | | |
| − | <syntaxhighlight lang="php">
| |
| − | libxml_disable_entity_loader(true);
| |
| − | </syntaxhighlight>
| |
| − | | |
| − | A description of how to abuse this in PHP is presented in a good [https://www.sensepost.com/blog/2014/revisting-xxe-and-abusing-protocols/ SensePost article] describing a cool PHP based XXE vulnerability that was fixed in Facebook.
| |
| − | | |
| − | ==References==
| |
| − | * [https://resources.infosecinstitute.com/identify-mitigate-xxe-vulnerabilities/ XXE by InfoSecInstitute]
| |
| − | * [[Top_10-2017_A4-XML_External_Entities_(XXE)| OWASP Top 10-2017 A4: XML External Entities (XXE)]]
| |
| − | * [https://vsecurity.com//download/papers/XMLDTDEntityAttacks.pdf Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks"]
| |
| − | * [https://find-sec-bugs.github.io/bugs.htm#XXE_SAXPARSER FindSecBugs XXE Detection]
| |
| − | * [https://github.com/ssexxe/XXEBugFind XXEbugFind Tool]
| |
| − | * [[Testing for XML Injection (OTG-INPVAL-008)]]
| |
| − | | |
| − | = Authors and Primary Editors =
| |
| − | | |
| − | [[User:wichers|Dave Wichers]] - dave.wichers[at]owasp.org<br />
| |
| − | [[User:Xiaoran_Wang|Xiaoran Wang]] - xiaoran[at]attacker-domain.com<br />
| |
| − | James Jardine - james[at]jardinesoftware.com<br />
| |
| − | Tony Hsu (Hsiang-Chih)<br />
| |
| − | [[User:Dfleming|Dean Fleming]]
| |
| − | | |
| − | = Other Cheatsheets =
| |
| − | | |
| − | {{Cheatsheet_Navigation_Body}}
| |
| − | [[Category:Cheatsheets]]
| |
| − | |}
| |
