This document discusses XML External Entity (XXE) attacks. It begins with an introduction to XML and DTDs. It then explains how XML entities work and how parsers handle XML. The document outlines several attack vectors for XXE, including local file inclusion, internal port scanning, denial of service, and in rare cases, remote code execution. It provides examples of XXE in different contexts like Microsoft Office documents and JSON payloads. Finally, it recommends solutions like disabling external DTD fetching and entity parsing to prevent XXE vulnerabilities.

1. Web Application Security - Team bi0s © 2017
XXE
XML External Entity
25 February
2017
@Team bi0s 1/25
HEERAJ
Btech, Third Year, Computer Science Engineering
Amrita University

2. whoami
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Undergraduate Student @ Amrita
➔ Web Security Enthusiast
➔ CTF{flag_seeker}
➔ @HRJ
➔ ww.i4info.in
2/25

3. Agenda
Web Application Security - Team bi0s © 2017 @Team bi0s
➔Intro to XML & DTD
➔XML Entity
➔Parsing XML
➔Attacks Vector
➔Demo
3/25

4. XML
Web Application Security - Team bi0s © 2017 @Team bi0s
➔EXtensible Markup Language
4/25
Picture:123RF.COM

5. Where it is used ?
Web Application Security - Team bi0s © 2017 @Team bi0s
➔Document Formats
➔Image Formats
➔Configuration Files
➔Network Protocols
➔RSS Feeds … etc . . .
5/25
Picture: c-sharpcorner.com

6. Document Type Definition
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ References an External
DTD
➔ Define structure with the list of legal
elements
6/25

7. XML Entity
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Entities help to reduce the entry of
repetitive information and also allow
for easier editing
Output:
Writer: Donald Duck. Copyright: bi0s.
7/25

8. XML Entity
Web Application Security - Team bi0s © 2017 @Team bi0s
XML Entity
Internal Entity External Entity
8/25

9. Parsing
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Character other than < , > , & , ‘ , “ all are parsable.
➔ PCDATA is text that will be parsed by a parser. Tags inside
the text will be treated as markup and entities will be
expanded.
➔ CDATA is text that will not be parsed by a parser.
9/25

10. Attack’s Possible
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ LFI
➔ SSRF
➔ Internal scans
➔ Denial of Service
➔ Rce (Not Always!!!)
10/25

11. Attack Vectors
Web Application Security - Team bi0s © 2017 @Team bi0s
Classic XXE
We can view any file which doesn’t contain < , > , & , ‘ , “ as characters.
11/25

12. 12

13. Direct Feedback Channel
Web Application Security - Team bi0s © 2017 @Team bi0s
What if
you are Reading
Some configuration files?
13

14. Direct Feedback Channel
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ CDATA very helpful to read web configuration, which contain non
parsable characters.
But this won’t work !!
14/25

15. Direct Feedback Channel
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ We have to use Parameter entities
➢ Parameter.dtd
15/25

16. Out Of Band Channel
Web Application Security - Team bi0s © 2017 @Team bi0s 16/25

17. Out Of Band Channel
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ No Direct Feedback Channel
17/25
Website: http://web-in-security.blogspot.in/2016/03/xxe-cheat-
sheet.html

18. Billion Laughs Attack (Simple Denial of
Service)
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Works by expansion property (Simple code(<1kb) will expand up to 3
gigabytes of memory.
18/25

19. Different Protocols
Web Application Security - Team bi0s © 2017 @Team bi0s 19/25

20. OFFICE OPEN XML
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Zip archive file containing XML and media files
➔ *.docx , *.xlsx , *.pptx
➔ Developed by Microsoft
20/25

21. OFFICE OPEN XML
Web Application Security - Team bi0s © 2017 @Team bi0s 21/25
Open XML File Container
Document
Properties
Custom Defined
XML
Comments
WordML/
SpreadsheetML etc
Embedded
Code/Macros
Images, Video,
Sound Files
Charts

22. OFFICE OPEN XML
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ General Parsing XML
◆ /_rels/.rels
◆ [Content_Types].xml
◆ Default Main Document
● /word/document.xml
● /ppt/presentation.xml
● /xl/workbook.xml
22/25

23. Playing With Content Type
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Server may accept multiple data formats
➔ Results in Json endpoints may be vulnerable to XXE
➔ Content-Type changed to application/xml
➔ JSON has to be converted to XML
23/25

24. Demo
Web Application Security - Team bi0s © 2017 @Team bi0s 24/25

25. Solution
Web Application Security - Team bi0s © 2017 @Team bi0s
➢ Don’t reflect the XML back to user
➢ Turn off external DTD fetching
➢ Turn off DTD
➢ Disable External Entity Parsing
libxml_disable_entity_loader(true);(PHP)
25/25