XXE
Description: XML External Entity (XXE) attacks exploit vulnerabilities in XML parsers that process external entities within XML documents. By injecting malicious XML entities, attackers can read files, access internal systems, or execute remote code on the server.
Example with Scenario: Consider a web application that accepts XML input for processing. If the XML parser is configured to resolve external entities, an attacker can inject a malicious entity to read sensitive files or perform network requests.
Payloads and Test Cases:
Basic XXE to Read Files:
Test Case: Verify if the response includes the content of
/etc/passwd.
Blind XXE with Out-of-Band Data Exfiltration:
Test Case: Check the server logs or network traffic to see if there is an outbound request to
http://attacker.com.
XXE to Perform SSRF:
Test Case: Observe if there is any interaction with internal services like
http://localhost/admin.
Billion Laughs Attack (Denial of Service):
Test Case: The server may crash or become unresponsive due to excessive resource consumption.
XXE with Parameter Entities (File Disclosure):
Test Case: Check for network traffic to
http://attacker.comcontaining the file content.
Mitigation:
Disable External Entity Resolution:
Configure the XML parser to disable external entity resolution.
Use a Secure XML Parser:
Use XML parsers that are secure by default, such as
defusedxmlin Python.
Input Validation:
Validate and sanitize XML input to ensure it does not contain any external entities.
Limit File System Access:
Run the application with the least privileges necessary, and restrict file system access.
Network Segmentation:
Ensure that servers processing XML input are not able to access sensitive internal networks.
Last updated