Tag Info

Hot answers tagged

12

I'm a PHP 'newbie' if you may call me one. But having analyzed XML and XSLT libraries in the past for security vulnerabilities, and having recently done work on an application that uses quite a bit of XML, here's what I could think of: If it is possible to pass in a XSL transformation that causes execution of privileged code, you might have to find some ...


8

The XML syntax allows for automatic inclusion of other files, which can be on the same system, or even elsewhere (through a URL). See for instance this documentation. The attack would be conceptually a case where the attacker can add an "external entity reference" in a piece of XML which will be interpreted as XML by a machine (e.g. a Web server), with the ...


7

With a bit of digging around, I've found some evidence of recent activity on this subject: Functional Explanation of Changes in XML Encryption 1.1 (W3C Working Group Note 11 April 2013). There are a lot of changes in the XML Encryption 1.1, among others: Added Key Derivation Added Elliptic Curve Diffie-Hellman Key Agreement Added Algorithms Changed ...


5

The primary risk in not syntax checking your XML is invalid parsing. If the software reading the XML can't handle invalid input, it might crash, do something unexpected, spontaneously explode (probably not), etc. Those situations can lead to security flaws - but if the software is brittle enough not to be able to handle invalid XML, it will very likely ...


5

Secure XML processing using DTD's and XSD's is tricky. You should ensure that the correct dtd's and xsd's are referenced for your use case before processing the xml file with a parser (and that mixed xml content is not added such as alternate xmlns, local dtd definitions in the xml, Entity expansions etc). As I heard on an OWASP podcast OWASP Podcast ...


5

According to Jager's and Somorovsky's paper "How to Break XML Encryption" (PDF), The W3C XML Encryption specification today marks the de-facto standard for data encryption in complex distributed applications. The use of XML as core data syntax, e.g. for major business, e-commerce, financial, healthcare, governmental and military applications, has ...


5

Actually, the whole WCF/SOAP security stack in .NET is based around these sets of standards for encryption and signing (if you are referring to what Thomas linked to). Message security with encryption uses it to encrypt the message. I have no hard evidence of it, but I believe its fairly well used in WCF-centric shops. We use it for our stuff. It's all ...


5

A parameter is a parameter: a data element (necessarily a character string, in the context of a URL) indexed by a formal name. What is done with that parameter on the server is entirely up to the server. We here enter the realm of suppositions. The parameter name "xmlPath" is suggestive of the parameter value being a path name for a file which uses XML. We ...


3

You didn't give us information about how the XML is used/parsed afterwards. Still I've got two points on this: By using something like http://host/file.xml?a=b%20x=y someone will be able to add an additional attribute depending on how you deal with the output, this might be a problem. Also some parsers take the first occurrence of an attribute, some the ...


3

Yes. By definition, allowing user interaction with additional software increases the Attack surface.


3

You cannot really test an ASN.1 parser for correction, because it is a complex piece of software and we do not know how to prove that a given piece of software is correct. What you can do is rely on a library with good repute. You might want to have a look at this question. Alternatively, reimplement it yourself; this is not very hard if you stick to a ...


2

Yes, of course. It's the same as a code review, or a deployment inspection. During CR, I would expect configuration files to be part of the code base that is examined; and during a deployment inspection, all configurations you can get your hands on should be opened up and examined. That also answers no.2 - explain to the manager that its part of the ...


2

Well, the first thing that comes to mind is that if you remove an external endpoint of an API that an application relies on, then yeah, it would probably break. :) More specifically it really depends on the application in question. If it only works over XMLRPC and it needs to connect from a different machine, then yes it will break if you remove the access. ...


2

No idea how Microsoft internal tools interacts with the service. You'd have to ask them, and they won't tell you. A friend used to work in MSIT building said tools, and even he wouldn't tell me. However, there should be a sample in the Windows SDK that gets installed here (source: ...


2

for XXE please read: http://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution http://blog.h3xstream.com/2014/06/identifying-xml-external-entity.html i can confirm a similar attack worked on Java/Tomcat And then there is a Billion Laugh - Attack ( i think this was what Bruno referred to) http://en.wikipedia.org/wiki/Billion_laughs


2

So XXE is usually seen in areas of a site which accept user input. If by static site, you mean a site that purely responds to HTTP GET requests for documents hosted on a server, then there's not really anywhere for XXE to occur. The only scenario I could think of would be if the site processed a section of the URL or HTTP headers and included that as an ...


1

The way we decided to address XML expansion and XXE vulnerabilities is to search for the !ENTITY and !DOCTYPE substring in the XML. If they exist, the XML was sent by an attacker because they are not sent by the application. We also decided to count < and > in order to protect from an attack like @Bruno Rohée suggested and only parse the document if ...


1

You are on the right track, with XML encoding. You can't predict all possible malicious content, so encoding dynamic data to guarantee it is benign is the right approach. The issue you've run into is that things get really wonky if you try to handle output encoding for multiple output locations all at once. The right approach (and you're close) is to encode ...


1

Could it? Yes. Is it? That's less certain. If your MySQL server is configured properly, it isn't accessible from the Internet at large, and the credentials are useless to anyone who doesn't have the ability to run code on the server. Of course, this assumes that the username and password are unique to the server.


1

The client proceeds as follows (I am considering only the encryption and signature steps as these are relevant for you): 1) Encryption: It generates a fresh 3DES symmetric key It encrypts the newly generated symmetric key with the public key of the server (using the RSA-PKCS1 algorithm, see EncryptionMethod algorithm) and places it into the ...


1

Just to flesh this out a little past your original point about browsers. Usually XXE is an attack on the server-side, so a user viewing the site can get access to files outside of the webroot, to which they would not normally have access. The access and impact of the XXE depends on whether there are useful files findable by the attacker and also the ...


1

Yes -- sort of. (IMO) It should be up to that team to define minimum requirements; e.g. which encryption methods to use, but they shouldn't lock down the likes of exposed methods. That should belong to developer security architects. Unless of course the IT Security Team has developers on it. EDIT: It is a little much to expect a firewall administrator ...


1

Document types (or DOCTYPE) is a declarative and semantical element which is part of the W3C specification regarding markup languages documents (such as XHTML). Their presence (or non-presence) within a markup document does not influence a whatever security aspect when they are being rendered and processed by a web browser. If you are writing an XHTML 1.1 ...


1

If your goal is to defend against XML bomb attacks, a special DTD or schema is not the right defense. The most robust defense is probably to place resource limits on your XML parser. For instance, run your XML parser in a separate process, with limits on how much memory and CPU time it can use; if it exceeds those limits, kill the parser and treat this as ...



Only top voted, non community-wiki answers of a minimum length are eligible