Tag Info

Hot answers tagged

12

I'm a PHP 'newbie' if you may call me one. But having analyzed XML and XSLT libraries in the past for security vulnerabilities, and having recently done work on an application that uses quite a bit of XML, here's what I could think of: If it is possible to pass in a XSL transformation that causes execution of privileged code, you might have to find some ...


8

The XML syntax allows for automatic inclusion of other files, which can be on the same system, or even elsewhere (through a URL). See for instance this documentation. The attack would be conceptually a case where the attacker can add an "external entity reference" in a piece of XML which will be interpreted as XML by a machine (e.g. a Web server), with the ...


6

With a bit of digging around, I've found some evidence of recent activity on this subject: Functional Explanation of Changes in XML Encryption 1.1 (W3C Working Group Note 11 April 2013). There are a lot of changes in the XML Encryption 1.1, among others: Added Key Derivation Added Elliptic Curve Diffie-Hellman Key Agreement Added Algorithms Changed ...


5

A parameter is a parameter: a data element (necessarily a character string, in the context of a URL) indexed by a formal name. What is done with that parameter on the server is entirely up to the server. We here enter the realm of suppositions. The parameter name "xmlPath" is suggestive of the parameter value being a path name for a file which uses XML. We ...


5

According to Jager's and Somorovsky's paper "How to Break XML Encryption" (PDF), The W3C XML Encryption specification today marks the de-facto standard for data encryption in complex distributed applications. The use of XML as core data syntax, e.g. for major business, e-commerce, financial, healthcare, governmental and military applications, has ...


5

Actually, the whole WCF/SOAP security stack in .NET is based around these sets of standards for encryption and signing (if you are referring to what Thomas linked to). Message security with encryption uses it to encrypt the message. I have no hard evidence of it, but I believe its fairly well used in WCF-centric shops. We use it for our stuff. It's all ...


4

Secure XML processing using DTD's and XSD's is tricky. You should ensure that the correct dtd's and xsd's are referenced for your use case before processing the xml file with a parser (and that mixed xml content is not added such as alternate xmlns, local dtd definitions in the xml, Entity expansions etc). As I heard on an OWASP podcast OWASP Podcast ...


4

The primary risk in not syntax checking your XML is invalid parsing. If the software reading the XML can't handle invalid input, it might crash, do something unexpected, spontaneously explode (probably not), etc. Those situations can lead to security flaws - but if the software is brittle enough not to be able to handle invalid XML, it will very likely ...


3

You didn't give us information about how the XML is used/parsed afterwards. Still I've got two points on this: By using something like http://host/file.xml?a=b%20x=y someone will be able to add an additional attribute depending on how you deal with the output, this might be a problem. Also some parsers take the first occurrence of an attribute, some the ...


3

You cannot really test an ASN.1 parser for correction, because it is a complex piece of software and we do not know how to prove that a given piece of software is correct. What you can do is rely on a library with good repute. You might want to have a look at this question. Alternatively, reimplement it yourself; this is not very hard if you stick to a ...


2

Well, the first thing that comes to mind is that if you remove an external endpoint of an API that an application relies on, then yeah, it would probably break. :) More specifically it really depends on the application in question. If it only works over XMLRPC and it needs to connect from a different machine, then yes it will break if you remove the access. ...


2

Yes, of course. It's the same as a code review, or a deployment inspection. During CR, I would expect configuration files to be part of the code base that is examined; and during a deployment inspection, all configurations you can get your hands on should be opened up and examined. That also answers no.2 - explain to the manager that its part of the ...


2

No idea how Microsoft internal tools interacts with the service. You'd have to ask them, and they won't tell you. A friend used to work in MSIT building said tools, and even he wouldn't tell me. However, there should be a sample in the Windows SDK that gets installed here (source: ...


1

Could it? Yes. Is it? That's less certain. If your MySQL server is configured properly, it isn't accessible from the Internet at large, and the credentials are useless to anyone who doesn't have the ability to run code on the server. Of course, this assumes that the username and password are unique to the server.


1

The client proceeds as follows (I am considering only the encryption and signature steps as these are relevant for you): 1) Encryption: It generates a fresh 3DES symmetric key It encrypts the newly generated symmetric key with the public key of the server (using the RSA-PKCS1 algorithm, see EncryptionMethod algorithm) and places it into the ...


1

Just to flesh this out a little past your original point about browsers. Usually XXE is an attack on the server-side, so a user viewing the site can get access to files outside of the webroot, to which they would not normally have access. The access and impact of the XXE depends on whether there are useful files findable by the attacker and also the ...


1

Document types (or DOCTYPE) is a declarative and semantical element which is part of the W3C specification regarding markup languages documents (such as XHTML). Their presence (or non-presence) within a markup document does not influence a whatever security aspect when they are being rendered and processed by a web browser. If you are writing an XHTML 1.1 ...


1

Yes -- sort of. (IMO) It should be up to that team to define minimum requirements; e.g. which encryption methods to use, but they shouldn't lock down the likes of exposed methods. That should belong to developer security architects. Unless of course the IT Security Team has developers on it. EDIT: It is a little much to expect a firewall administrator ...



Only top voted, non community-wiki answers of a minimum length are eligible