{"id":738,"date":"2021-04-14T08:28:06","date_gmt":"2021-04-14T08:28:06","guid":{"rendered":"https:\/\/shreyapohekar.com\/blogs\/?p=738"},"modified":"2021-04-25T09:01:11","modified_gmt":"2021-04-25T09:01:11","slug":"xxe-simplified-the-concept-attacks-and-mitigations","status":"publish","type":"post","link":"https:\/\/shreyapohekar.com\/blogs\/xxe-simplified-the-concept-attacks-and-mitigations\/","title":{"rendered":"XXE Simplified: The concept, Attacks and Mitigations"},"content":{"rendered":"\n

Whenever I scroll through hackerone reports, XXE remains amongst the one with a critical score on the severity perspective. Why? Being able to read server’s sensitive files is where the victim can be fully compromised. Whatever, security measures are in place fails if there’s a hole in the pot. XXE can be considered that vulnerability that could do severe harm to the organization!!<\/p>\n\n\n\n

Hey Everyone! This blog post will cover the basic elements of XML and why XXE arise in the first place. In the latter part, I will cover various attack scenarios around XXE. Finally, we’ll look at the mitigations. <\/p>\n\n\n\n

To exfilterate data with XXE, follow this post.<\/span><\/a><\/p>\n\n\n\n

The basics of XML<\/h2>\n\n\n\n

Like JSON, XML is a language that can be used for storing and transportation of data. It follows tree-like structure for data representation.<\/p>\n\n\n\n

XML entities<\/h2>\n\n\n\n

Entities are the way by which the data can be represented in XML.<\/p>\n\n\n\n

Document type definition [DTD]<\/h2>\n\n\n\n

DTD defines the structure and legal elements and attributes of an XML document. Like I said XML can be used for transporting data, there should be a common standard accepted by everyone. Therefore, a DTD helps to check the validity of an XML document. DTDs can be both internal as well as external.<\/p>\n\n\n\n

Internal DTD with elements<\/h3>\n\n\n\n
<?xml version=\"1.0\"?>\n<!DOCTYPE todo [\n<!ELEMENT todo (name)>\n<!ELEMENT name (#PCDATA)>\n]>\n<todo>\n<name>Go to gym<\/name>\n<\/todo><\/code><\/pre>\n\n\n\n
The example defines a DOCTYPE named todo which contains a name of todo. So thats the format we have defined. And the xml document is expected to follow the defined structure.<\/p>\n\n\n\n
Elements are actual markup tags defined by the DTD, just like HTML’s <p> or <h1><\/p>\n\n\n\n
<name><\/name> is a user defined element.<\/p>\n\n\n\n
If you are wondering what is #PCDATA, hold on for a while. I will cover its significance later in this post.<\/p>\n\n\n\n
Internal DTD with entities<\/h3>\n\n\n\n
<!DOCTYPE foobar [ <!ENTITY test \"Test123\" > ]><\/code><\/pre>\n\n\n\n
This is a DTD with an entity, declared with name test and its value is “Test123”. Now this entity can be referenced in the XML document with &. Ex.<\/p>\n\n\n\n
<lol>&test;<\/lol><\/code><\/pre>\n\n\n\n
Whenever the XML document will be parsed, Test123 will be reflected.<\/p>\n\n\n\n
Parameter Entities<\/h3>\n\n\n\n
Parameter entities behave like and are declared almost exactly like a general entity. However, they use a % instead of an &, and they can only be used in a DTD while general entities can only be used in the document content.<\/p>\n\n\n\n
Syntax<\/p>\n\n\n\n
<!ENTITY % name   \"foobar\"><\/code><\/pre>\n\n\n\n
Deferencing<\/p>\n\n\n\n
<!ELEMENT employee (%name;)><\/code><\/pre>\n\n\n\n
Parameter entities are useful when entities have to be nested in DOCTYPE element. Parameter entities are significantly used to exploit <\/a>Blind XXE with out-of-band-interaction<\/a>.<\/span> We’ll see the usage in detail in the follow-up post.<\/a> <\/span><\/p>\n\n\n\n
That builds the fundamentals. Now comes the attack – XXE<\/p>\n\n\n\n
So lets understand what is XXE and how it happens.<\/p>\n\n\n\n
What is XXE <\/h2>\n\n\n\n
XXE (External XML Entity) is a vulnerability that allows the adversary to maliciously interact with the parsing of xml data.           With a successful XXE attack, an attacker will be able to view server’s sensitive files like \/etc\/passwd. <\/p>\n\n\n\n
Wondering how? Lets take an example.<\/p>\n\n\n\n
<!DOCTYPE foo [ <!ENTITY malxxe SYSTEM \"file:\/\/\/path\/to\/file\" > ]>\n\n<\/code><\/pre>\n\n\n\n
Entity malxxe is defined that uses SYSTEM identifier. A system identifier is nothing but a URI (Uniform resource identifier).  file:\/\/\/path\/to\/file is a URI. When &malxxe; is referenced in any element, the contents of file are displayed.<\/p>\n\n\n\n
XXE can also be leveraged with other attacks such as SSRF to further increase the impact of compromise.   <\/p>\n\n\n\n
XXE attacks arise when the XML parsers are poorly configured.       <\/p>\n\n\n\n
There are multiple risk factors that can potentially be an entry point for XXE<\/h2>\n\n\n\n