Downloaded 51 times
![XML External Entities
[XXE]
Slipping in through the XML backdoor](https://image.slidesharecdn.com/xmlexternalentitiesxxe-150514141054-lva1-app6891/85/Xml-external-entities-xxe-1-320.jpg)
![[OWASP Poland Day] Application security - daily questions & answers](https://cdn.slidesharecdn.com/ss_thumbnails/owasp-applicationsecurity-171003211500-thumbnail.jpg?width=640&height=640&fit=bounds)
![[Blackhat2015] FileCry attack against Java](https://cdn.slidesharecdn.com/ss_thumbnails/us-15-wang-filecry-the-new-age-of-xxe-java-wp-150807171804-lva1-app6892-thumbnail.jpg?width=640&height=640&fit=bounds)
Xml external entities [xxe]
- 1. XML External Entities [XXE] Slippingin through the XML backdoor
- 2.
- 3. What is it? •XML 1.0 specification allows for “Entity Declaration” • This allows XML documents to be more dynamic • Here are a couple examples
- 4. Who is affected? •Lots of apps use XML • Lots of formats rely on XML • Lots of configuration files for apps use XML • Lots of protocols rely on XML • Some use it without even knowing it
- 5. Who cares? • Attackerand defenders should care because… this is also a valid XXE Declaration:
- 6. Who cares? • Attackerand defenders should care because… this is also a valid XXE Declaration: • …aaaaaand so is this!
- 7. What can youexploit? • Denial of service • File enumeration • Network enumeration • Port scanning • Directory listing • File exfiltration …sometimes WITHOUT AUTH
- 8.
- 9. How do youstop it? • Coders that know about XXE don’t reflect XML back • But that didn’t work well • Because error messages • Because response timing differences • Because Timur Yunusov & Alexey Osipov Out-of-Band XXE attack
- 10. How do youstop it? Take two • A lot of parser libraries added the option to disable XXE • But that didn’t work well • Because many coders don’t realize this is an attack vector
- 11. How do youstop it? Take three • A lot of parser libraries disable XXE by default • Actually works pretty well • …provided your libraries are up to date. • …no dumb ass developers enabled ittt
- 12. Summary • XML isall over the place • XXE is really bad • If defending, make sure you are not vulnerable • If attacking, make sure you test for XXE, cause it’s really SWEET if you find it
- 13. Shout-outs • Lots ofsmart people have researched and talked about this • Timur Yunusov & Alexey Osipov OOB XXE talk at Blackhat 2013 • Timothy D. Morgan - What You Didn't Know About XML External Entities Attacks • Alex Lauerman @ TrustFoundry
Editor's Notes
- #2 Introduce yourself. And who you work for.
- #3 I get a nerd boner whenever I see xml in applications because of how big of an impact this has. Tell Alex’s story of exfiltrating data from very secure services that have been pentested before.
- #4 Take your time and zoom in on these and explain them
- #5 Lots of apps use XML without even knowing it. Talk about that one JSON ->XML, XXE attack you did
- #6 explaining that you can reference an entity on an attacker’s machine this Take your time and zoom-in
- #7 Explain that you can include local files on the system Take your time and zoom-in
- #8 Explain here the app you found that used a xml webservice They did the right thing and used an AUTH token to verify access to the service But the token was an XML element, so the app had to parse XML before it could verify authorization. This means I get their webconfig file as an UNAUTHENTICATED ATTACKER
- #9 Turnkey Linux running python manage.py runserver 192.168.48.128:999 Firefox Burp Running http://192.168.48.128:999/static/mailingList.html try this after xml tag <!DOCTYPE root [<!ELEMENT root ANY> <!ENTITY foo "XXEEEEEE!!!!" >]> Do this to pop the exploit <!DOCTYPE root [<!ELEMENT root ANY> <!ENTITY foo SYSTEM "file:///etc/passwd" >]>
- #10 Take your time, Explain each one of these Explain the out of bounds XXE attack
- #12 Explain here for the example, I installed Django from 2013 so apps that are 2+ years old probably don’t have xxe disabled by default but Explain that I have found it on real tests twice in the last year and Alex has found it at least 3 or 4 times
- #14 Explain that I will be making the fuzzing list and the vulnerable Django app available on github