Tweeted twitter.com/StackSecurity/status/765182275378184192
2 deleted 11 characters in body
source | link

I have PHP code that uses the loadXML function (as well as other XML functions).

  1. Is the loadXML function vulnerable to XXE attack? Namely, if the XML contains external entities, will they be interpreted?

  2. Is this function vulnerable to other XML based attacks? eE.g., the Billion Laughs DoS attack?

  3. Can you refer me to a list of functions that are vulnerable to XXE and to other XML-related attacks?

I know that it is possible to easily block XXE attacks in PHP by changing the settings. Yet, I will be glad to get answers to the questions I raised.

Thanks!

I have PHP code that uses the loadXML function (as well as other XML functions).

  1. Is the loadXML function vulnerable to XXE attack? Namely, if the XML contains external entities, will they be interpreted?

  2. Is this function vulnerable to other XML based attacks? e.g., the Billion Laughs DoS attack?

  3. Can you refer me to a list of functions that are vulnerable to XXE and to other XML-related attacks?

I know that it is possible to easily block XXE attacks in PHP by changing the settings. Yet, I will be glad to get answers to the questions I raised.

Thanks!

I have PHP code that uses the loadXML function (as well as other XML functions).

  1. Is the loadXML function vulnerable to XXE attack? Namely, if the XML contains external entities, will they be interpreted?

  2. Is this function vulnerable to other XML based attacks? E.g., the Billion Laughs DoS attack?

  3. Can you refer me to a list of functions that are vulnerable to XXE and to other XML-related attacks?

I know that it is possible to easily block XXE attacks in PHP by changing the settings. Yet, I will be glad to get answers to the questions I raised.

1
source | link

Is PHP loadXML vulnerable to XXE attack (and to other attacks)? Is there a list of vulnerable functions?

I have PHP code that uses the loadXML function (as well as other XML functions).

  1. Is the loadXML function vulnerable to XXE attack? Namely, if the XML contains external entities, will they be interpreted?

  2. Is this function vulnerable to other XML based attacks? e.g., the Billion Laughs DoS attack?

  3. Can you refer me to a list of functions that are vulnerable to XXE and to other XML-related attacks?

I know that it is possible to easily block XXE attacks in PHP by changing the settings. Yet, I will be glad to get answers to the questions I raised.

Thanks!