This document discusses XML External Entity (XXE) vulnerabilities. It begins with an introduction of XML and DTDs. It then explains how XML entities work and how XML is parsed. It outlines several attack vectors for XXE vulnerabilities, including denial of service, local file inclusion and internal port scanning. It also provides examples of the billion laughs attack and how to exploit XXE vulnerabilities in JSON endpoints by changing the content type. The document concludes with recommendations for preventing XXE issues like validating user input, disabling external DTD fetching and external entity parsing.

1. Web Application Security - Team bi0s © 2017
XXE
XML External Entity
25 February
2017
@Team bi0s 1/25
HEERAJ
Btech, Third Year, Computer Science
Engineering
Amrita University

2. whoami
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Undergraduate Student @ Amrita
➔ Web Security Enthusiast
➔ CTF{flag_seeker}
➔ @heerajnair
➔ ww.i4info.in
2/25

3. Agenda
Web Application Security - Team bi0s © 2017 @Team bi0s
➔Intro to XML & DTD
➔XML Entity
➔Parsing XML
➔Attack Vectors
➔Demo
3/25

4. XML
Web Application Security - Team bi0s © 2017 @Team bi0s
➔EXtensible Markup Language
4/25
Picture:123RF.COM

5. Where it is used ?
Web Application Security - Team bi0s © 2017 @Team bi0s
➔Document Formats
➔Image Formats
➔Configuration Files
➔Network Protocols
➔RSS Feeds … etc . . .
5/25
Picture: c-sharpcorner.com

6. Document Type Definition
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ References an External
DTD
➔ Define structure with the list of legal
elements
6/25

7. XML Entity
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Entities help to reduce the entry of
repetitive information
Output:
Writer: Donald Duck. Copyright: bi0s.
7/25

8. XML Entity
Web Application Security - Team bi0s © 2017 @Team bi0s
XML Entity
Internal Entity External Entity
8/25

9. Parsing
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Character other than < , > , & , ‘ , “ all are parsable.
➔ PCDATA is text that will be parsed by a parser.
➔ CDATA is text that will not be parsed by a parser.
◆ Ex : <![CDATA[<data>Hello, world!]]>
9/25

10. Attack’s Possible
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Denial Of Service
➔ Local File Inclusion
➔ SSRF
➔ Internal scans
➔ Rce (Not Always!!!)
10/25

11. Billion Laughs Attack
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Works by expansion property (Simple code(<1kb) will expand up to 3
gigabytes of memory.
11/25
Website: digitalimprint.com

12. Attack Vectors
Web Application Security - Team bi0s © 2017 @Team bi0s
Classic XXE
We can view any file which doesn’t contain < , > , & , ‘ , “ as characters.
12/25

13. 13

14. OFFICE OPEN XML
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Zip archive file containing XML and media files
➔ *.docx , *.xlsx , *.pptx
➔ Developed by Microsoft
14/25

15. OFFICE OPEN XML
Web Application Security - Team bi0s © 2017 @Team bi0s 15/25

16. OFFICE OPEN XML
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Files in OOXML
◆ /_rels/.rels
◆ [Content_Types].xml
◆ Default Main Document
● /word/document.xml
● /ppt/presentation.xml
● /xl/workbook.xml
16/25

17. Direct Feedback Channel
Web Application Security - Team bi0s © 2017 @Team bi0s
What if
you are Reading
Some configuration files?
17/25

18. Different Protocols
Web Application Security - Team bi0s © 2017 @Team bi0s 18/25
php://filter/convert.base64-encode/resource=/etc/passwd

19. Direct Feedback Channel
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ CDATA very helpful to read web configuration, which contain non
parsable characters.
But this won’t work !!
19/25

20. Direct Feedback Channel
Web Application Security - Team bi0s © 2017 @Team bi0s 20/25
1. XML Request
Parsing
Attacker’s Server
Host

21. Direct Feedback Channel
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ We have to use Parameter entities
➢ Parameter.dtd
21/25

22. Out Of Band Channel
Web Application Security - Team bi0s © 2017 @Team bi0s 22/25
1. XML Request
Parsing
Attacker’s Server
Host

23. Out Of Band Channel
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ No Direct Feedback Channel
23/25

24. Demo
Web Application Security - Team bi0s © 2017 @Team bi0s
XXE Cheat Sheet: http://web-in-security.blogspot.in/2016/03/xxe-cheat-sheet.html
24/25

25. Solution
Web Application Security - Team bi0s © 2017 @Team bi0s
➢ Validation of user input
➢ Turn off external DTD fetching
➢ Disable External Entity Parsing
libxml_disable_entity_loader(true);(PHP)
25/25

26. 26

27. Playing With Content Type
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Server may accept multiple data formats
➔ Results in Json endpoints may be vulnerable to XXE
➔ Content-Type changed to application/xml
➔ JSON has to be converted to XML
27/25

28. OFFICE OPEN XML
Web Application Security - Team bi0s © 2017 @Team bi0s 28/25
Open XML File Container
Document
Properties
Custom Defined
XML
Comments
WordML/
SpreadsheetML etc
Embedded
Code/Macros
Images, Video,
Sound Files
Charts