12

I have PHP code that uses the loadXML function (as well as other XML functions).

  1. Is the loadXML function vulnerable to XXE attack? Namely, if the XML contains external entities, will they be interpreted?

  2. Is this function vulnerable to other XML based attacks? E.g., the Billion Laughs DoS attack?

  3. Can you refer me to a list of functions that are vulnerable to XXE and to other XML-related attacks?

I know that it is possible to easily block XXE attacks in PHP by changing the settings. Yet, I will be glad to get answers to the questions I raised.

  • 1
    Some of these like the DoS attack can easily be tested by yourself. – André Borie Aug 15 '16 at 9:07
  • Being it PHP, I can give a much shorter lists of functions that are not vulnerable. – Kroltan Aug 15 '16 at 20:49
14

Is the loadXML function vulnerable to XXE attack? Namely, if the XML contains external entities, will they be interpreted?

By default, no.

External Entities are not parsed without LIBXML_NOENT being set. If libxml_disable_entity_loader is set to true, not even LIBXML_NOENT will allow XXE.

Is this function vulnerable to other XML based attacks? e.g., the Billion Laughs DoS attack?

No, billion laughts will be caught with default settings:

DOMDocument::loadXML(): Detected an entity reference loop in Entity

What will not be caught is quadratic blowup. Note that the entities need to actually be substituted, which is either done via the rather poorly named LIBXML_NOENT or by simply accessing the node (eg via textContent).

  • 7
    The name of this flag is so horribly confusing, as is the complete lack of official documentation. – Polynomial Aug 15 '16 at 10:58
  • 20
    @Polynomial: Welcome to PHP. – Williham Totland Aug 15 '16 at 12:04
  • 5
    @WillihamTotland PHP is pretty awful regarding naming and documenting. But noent is already present in libxml (at least as parameter in their command line tool, and the other bindings such as ruby use the same flag as well). – tim Aug 15 '16 at 12:17
  • 9
    @tim A poorly named, poorly document flag that can't be blamed on PHP? Frankly, I never thought I'd see the day. ;) – Williham Totland Aug 15 '16 at 12:22
  • An example of quadratic blowup: the billion lulz attack. – Naftuli Kay Aug 15 '16 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.