search

XML External Entity (XXE)

Source: https://www.synack.com/blog/a-deep-dive-into-xxe-injection/

hashtag
What are XML and DTD and Entities?

XXE attack completly depends on XML language. In this kind of attack we abuse the feature enabled by default: Entities.

Sample Document Type Definition (DTD) file:

Dtd structure can be found here: https://www.w3schools.com/xml/xml_dtd_intro.asparrow-up-right

<!DOCTYPE STRUCTURE [
<!ELEMENT SPECIFICATIONS (#PCDATA)>
<!ENTITY VERSION “1.1”>
<!ENTITY file SYSTEM “file:///c:/server_files/application.conf” >
]>

The DTD from above can be used in the following way in XML file:

<?xml version=”1.0″ encoding=”UTF-8″?>
<!DOCTYPE foo SYSTEM “http://validserver.com/formatting.dtd”>
<specifications>&file;</specifications>

ENTITYs can be used without the formality of a full .dtd file. By calling DOCTYPE and using square brackets [], you can reference ENTITY tags for use in only that XML file.

XML without DTD file:

  • DTD files can be external or internal to an XML file

  • ENTITYs exist within DTD files

  • ENTITYs can call local system files

hashtag
Video Explaination

hashtag
Regular Injection

In this attack we include malicious entity into schema and following certain DTD schema rules.

Request:

Response:

hashtag
Out of band

When XML External Entities are not returned back by the server we can try to sneak out of band.

chevron-rightHow attack below workshashtag

  • The client sends the POST request with the injected XML code

    • The server, via the XML parser, parses the XML from top to bottom, reaching the injected““ ENTITY

  • The server requests payload.dtd from https://evil-webserver.com

  • https://evil-webserver.com responds with payload.dtd

  • The code within payload.dtd is parsed by the XML parser, which reads the contents of win.ini and sends it as a parameter in an HTTP GET request back to https://evil-webserver.com

Code execution steps

We can reference our malicious server which hosts malicious .dtd file which will be executed in the following way:

Payload DTD hosted on the server:

hashtag
Pass the SOAP

SOAP (Simple Object Access Protocol) is a communication structure that allows numerous different applications/elements to communicate with each other. More importantly for us, it is also structured as XML, making it possibly vulnerable to XXE. (SOAP is something like JSON replacement)

Attack works just as in the Out of band method:

  1. Reach for dtd file

  1. dtd file contents

  1. Reading /etc/passwd file contents

hashtag
Recon with XXE (Post Exploitation)

XXE to gain Local File Disclosure (LFD) is useful as a PoC, but a real attacker might want to do more with XXE than just read local files.

Since XXE is instructing the server to execute something on its behalf, an attacker can use it to map internal hosts and/or ports by using the XML parser to perform Server Side Request Forgery (SSRF). Such an XXE + SSRF submission came across our queue last year. This specific vulnerability was exploited against JAMF Software which has an XML based protocol, like SOAP, making it potentially vulnerable to XXE.

Port scanning with XXE

If the port is open on the machine the server quickly responses:

hashtag
XXE to RCE

Having the PHP Expect module installed can result in code execution from an XXE attack.

PreviousErrors and additional informationNextTypes of XML Entities

Last updated