1. OWASP A4
XML External
Entities
Anat Mazar
Security Champion
Michael Furman
Security Architect

2. What will we see today?
• Background - XML and XML Entities
• What is an XML External Entities (XXE) attack?
• Preventing an XXE attack in Java
• An even better way ...

3. About Anat
• 5+ years in software engineering
• ~1 year as Security Champion at Tufin
• www.linkedin.com/in/anat-mazar
• I like to play board games, watch movies and
travel

4. About Michael
• 12+ years in application security
• 6+ years Lead Security Architect at Tufin
• www.linkedin.com/in/furmanmichael/
• ultimatesecpro@gmail.com
• Read my blog https://ultimatesecurity.pro/
• Follow me on twitter @ultimatesecpro
• I like to travel, read books and listen to music

5. About
• Market Leader in Security Policy Automation
• Tufin is used by >2000 enterprises
– To segment networks and connect applications
– On-prem networks, firewalls, cloud and K8S
• We are the Security Policy Company!

6. What is XML?
• eXtensible Markup Language
https://www.w3schools.com/xml/xml_whatis.asp
• Designed to store and transport data
• XML tags are not predefined

7. What is an XML Entity?
• Defines shortcuts to characters or words
• Can be declared as internal, external, or
predefined
• Internal entity declaration:
Usage:
<!ENTITY entity-name "entity-value">
<element>&entity-name;</ element >

8. What is an XML Entity?
• External entity declaration:
Usage:
• Predefined entities:
<!ENTITY entity-name SYSTEM "system-identifier">
<element>&entity-name;</ element >
&lt; &gt; &amp; &quot; &apos;

9. Risks Posed by XML Entities
• Attacker can include potentially hostile content in an
XML Entity
• Read a local file
• Send data out

10. Attacking with XML Entities
• What happens during the parsing of the file?
• The parser reads the local file
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:////etc/passwd" >]>
<xmlroot><xmlEntry>&xxe;</xmlEntry></xmlroot>

11. Attacking with XML Entities
• What happens during the parsing of the file?
• The parser executes the remote HTTP call
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "http://api.geonames.org/timezoneJSON" >]>
<xmlroot><xmlEntry>&xxe;</xmlEntry></xmlroot>

12. Flow of the attack
• The attack vector: a web application that
accepts XML input and parses it
Browser
WebServer
/etc/passwd
XML Parser
XML with XXE
XXE
XML with XXE
/etc/passwd/etc/passwd

13. Why is XML Entity Dangerous?
XML entities can be used by an attacker to steal
your passwords file!!

14. How Dangerous is XXE?
OWASP Top Ten 2017
• A1 Injection
• A2 Broken Authentication
• A3 Sensitive Data Exposure
• A4 XML External Entities
• A5 Broken Access Control
• A6 Security Misconfiguration
• A7 Cross-Site Scripting (XSS)
• A8 Insecure Deserialization
• A9 Using Components with Known Vulnerabilities
• A10 Insufficient Logging & Monitoring

15. OWASP A4 – In a Nutshell
• Attackers can exploit vulnerable XML processors if they can
upload XML or include hostile content in an XML
document.
https://www.owasp.org/index.php/Top_10-2017_A4-
XML_External_Entities_(XXE)
• The attack can be used to
• extract data
• execute a remote request from the server
• scan internal systems
• perform a denial-of-service attack
• as well as execute other attacks

16. Preventing an XXE attack
• Disable XML external entity and DTD processing in all
XML parsers in the application
• OWASP Cheat Sheet 'XXE Prevention':
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_C
heat_Sheet

17. Preventing an XXE attack in Java
• JAXB Unmarshaller
https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Preve
ntion_Cheat_Sheet.html#jaxb-unmarshaller
• JAXP DocumentBuilderFactory
https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Preve
ntion_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-
dom4j

18. Parsing XML - JAXB Unmarshaller
final Unmarshaller unmarshaller =
JAXBContext.newInstance(SimpleXmlEntry.class).createUnmarshaller();
final SimpleXmlEntry simpleXmlEntry =
(SimpleXmlEntry)unmarshaller.unmarshal(xmlSource);

19. Preventing XXE Attack - Unmarshaller
• Implemented in Java 8
• But ...
– Old JAXB version
• 2.2.5 and below
– Upgrade JAXB and resolve XXE

20. Preventing XXE Attack - Unmarshaller
• Configure Unmarshaller according to
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Preventio
n_Cheat_Sheet#Unmarshaller
• The prevention protects a single place in a code
SAXParserFactory spf = SAXParserFactory.newInstance();
spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);

21. Preventing XXE Attack - Unmarshaller
• Use preconfigured SafeSource
https://gitlab.com/ultimatesecpro/xxeprotection
• The prevention protects a single place in a code
Source xmlSource = SafeSource.newInstanceFromXmlContent(xml);
final Unmarshaller unmarshaller = JAXBContext.
newInstance(SimpleXmlEntry.class).createUnmarshaller();
final SimpleXmlEntry simpleXmlEntry =
(SimpleXmlEntry)unmarshaller.unmarshal(xmlSource);

22. Preventing XXE Attack - Unmarshaller
The better way ...
• Add new System Properties in a configuration file:
• The prevention protects all places in a process
-Djavax.xml.bind.context.factory=com.sun.xml.internal.bind.v2.ContextFactory"
-Djavax.xml.parsers.SAXParserFactory=
com.sun.org.apache.xerces.internal.jaxp.SAXParserFactoryImpl"

23. Preventing XXE Attack - Unmarshaller
The better way ...
• Add the file
with the content
• The prevention protects all places in a jar
com.sun.xml.internal.bind.v2.ContextFactory
.META-INFservicesjavax.xml.bind.JAXBContext

24. Parsing XML - JAXP DocumentBuilderFactory
DocumentBuilder builder = DocumentBuilderFactory
.newInstance().newDocumentBuilder();
Document doc =
builder.parse(new ByteArrayInputStream(xml.getBytes()));

25. • Configure DocumentBuilderFactory according to
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_She
et#JAXP_DocumentBuilderFactory.2C_SAXParserFactory_and_DOM4J
• The prevention protects a single place in a code
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
dbf.setFeature(FEATURE, true);
FEATURE = "http://xml.org/sax/features/external-general-entities";
dbf.setFeature(FEATURE, false);
...
Preventing XXE Attack - DocumentBuilderFactory

26. • Use SafeDocumentBuilderFactory
https://gitlab.com/ultimatesecpro/xxeprotection
• The prevention protects a single place in a code
DocumentBuilder builder = SafeDocumentBuilderFactory.newInstance()
.newDocumentBuilder();
Document doc = builder.parse(new ByteArrayInputStream(xml.getBytes()));
Preventing XXE Attack - DocumentBuilderFactory

27. The better way ...
• Use SafeDocumentBuilderFactoryImpl
https://gitlab.com/ultimatesecpro/xxeprotection
• Add new System Properties in a configuration file:
• The prevention protects all places in a process
-Djavax.xml.parsers.DocumentBuilderFactory=
org.ultimatesecpro.xxeprotection.SafeDocumentBuilderFactoryImpl
Preventing XXE Attack - DocumentBuilderFactory

28. “I need to use XML Entity”
• Add input validation for each XML entity
– Validate before an XML parsing
• Example:
– A message should include only alphanumeric characters
– If not reject a request
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY message SYSTEM "Wakanda Forever!" >]>
<xmlroot><xmlEntry>&message;</xmlEntry></xmlroot>

29. Sources
• Protection
https://gitlab.com/ultimatesecpro/xxeprotection
• Demo
https://gitlab.com/ultimatesecpro/xxedemo

30. Summary
• XML External Entities (XXE)
• How XXE can be used to implement an attack
• Solving it each time you parse XML in your code
• The better solution
Solve it once and for all - using system properties

31. Thank you!
• Contact us
– Anat
www.linkedin.com/in/anat-mazar
– Michael
www.linkedin.com/in/furmanmichael/
ultimatesecpro@gmail.com
https://ultimatesecurity.pro/
@ultimatesecpro

32. What is OWASP?
• OWASP - Open Web Application Security Project
• Worldwide not-for-profit organization
• Founded in 2001
• Its mission is to make the software security visible.

33. OWASP Top Ten
• Most successful OWASP Project
• Lists of ten most critical web application
security attacks
• Released first in 2004
• Released each 3 years
• 2007, 2010, 2013, 2017 (current)