Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So I found this explanation for a vulnerability on some cms :

The XML parser at /WorkArea/Blogs/xmlrpc.aspx is vulnerable to XML external entity attacks which can be used to Scan behind perimeter firewalls or possibly include files from the local file system e.g. ]> &test;

How can that issue be exploited . I have vulnerable cms on my home server. There isn't really much info on that. My goal is to learn something new. THanka

share|improve this question
    
I guess this sums it up perfectly: owasp.org/images/5/5d/XML_Exteral_Entity_Attack.pdf#page=30 –  Disenchant Feb 18 at 19:54

1 Answer 1

up vote 8 down vote accepted

The XML syntax allows for automatic inclusion of other files, which can be on the same system, or even elsewhere (through a URL). See for instance this documentation. The attack would be conceptually a case where the attacker can add an "external entity reference" in a piece of XML which will be interpreted as XML by a machine (e.g. a Web server), with the rights of that server; the attacker can then make the machine read a local file of his choosing (a file local to the server) and include it in the interpreted XML. If the interpreted XML is then sent back to the attacker, then the attacker gains a read access to the server local files.

We could imagine that in a CMS system, where the attacker can insert messages with a XML syntax. If the CMS allows arbitrary XML from the attacker, then the attacker can use external entities to read and display files like /etc/passwd (or even /etc/shadow if the CMS runs as root).

share|improve this answer
    
Brilliant explanation; even I understood. +1 –  Lex Feb 26 '13 at 18:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.