XML External Entity (XXE)
Source: https://www.synack.com/blog/a-deep-dive-into-xxe-injection/
What are XML and DTD and Entities?
XXE attack completly depends on XML language. In this kind of attack we abuse the feature enabled by default: Entities.
Sample Document Type Definition (DTD) file:
Dtd structure can be found here: https://www.w3schools.com/xml/xml_dtd_intro.asp
<!DOCTYPE STRUCTURE [
<!ELEMENT SPECIFICATIONS (#PCDATA)>
<!ENTITY VERSION “1.1”>
<!ENTITY file SYSTEM “file:///c:/server_files/application.conf” >
]>The DTD from above can be used in the following way in XML file:
<?xml version=”1.0″ encoding=”UTF-8″?>
<!DOCTYPE foo SYSTEM “http://validserver.com/formatting.dtd”>
<specifications>&file;</specifications>ENTITYs can be used without the formality of a full .dtd file. By calling DOCTYPE and using square brackets [], you can reference ENTITY tags for use in only that XML file.
XML without DTD file:
DTD files can be external or internal to an XML file
ENTITYs exist within DTD files
ENTITYs can call local system files
Video Explaination
Regular Injection
In this attack we include malicious entity into schema and following certain DTD schema rules.
Request:
Response:
Out of band
When XML External Entities are not returned back by the server we can try to sneak out of band.
We can reference our malicious server which hosts malicious .dtd file which will be executed in the following way:
Payload DTD hosted on the server:
Pass the SOAP
SOAP (Simple Object Access Protocol) is a communication structure that allows numerous different applications/elements to communicate with each other. More importantly for us, it is also structured as XML, making it possibly vulnerable to XXE. (SOAP is something like JSON replacement)
Attack works just as in the Out of band method:
Reach for dtd file
dtd file contents
Reading /etc/passwd file contents
Recon with XXE (Post Exploitation)
XXE to gain Local File Disclosure (LFD) is useful as a PoC, but a real attacker might want to do more with XXE than just read local files.
Since XXE is instructing the server to execute something on its behalf, an attacker can use it to map internal hosts and/or ports by using the XML parser to perform Server Side Request Forgery (SSRF). Such an XXE + SSRF submission came across our queue last year. This specific vulnerability was exploited against JAMF Software which has an XML based protocol, like SOAP, making it potentially vulnerable to XXE.
If the port is open on the machine the server quickly responses:
XXE to RCE
Having the PHP Expect module installed can result in code execution from an XXE attack.
Last updated