According to https://msdn.microsoft.com/en-us/library/mt661872.aspx and https://github.com/dotnet/roslyn-analyzers/issues/563 the code below is vulnerable to DTD expansion attack:

    var src = "?payload?";   
    TextReader tr = new StreamReader(src);   
    XmlSchema schema = XmlSchema.Read(tr, null);

Could someone provide an example (can be for older .NET since in 4.5.2 many defaults were fixed) of the possible malicious payload? I understand possible payloads for xml readers, but what would it be in xsd schema case?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.