XML External Entity attacks have been identified as an OWASP top 10 web application vulnerability. Whilst there seems to be extensive information on what an XML external entity attack is and how it can be prevented, I have not been able to find any detail on how it can be detected.

The syntax below is an example of an external entity. I understand that if application or web server logs include the detail of the XML body of incoming requests then there should be an ability to detect this attack by configuring alerting rules for strings that contain the words ENTITY and SYSTEM

Is this the most appropriate/efficient way to detect? Any other thoughts or experience with detecting this attack?

 <!ENTITY entity-name SYSTEM "URL/URI" >
  • 1
    If you're prepared to treat every use of external entities as an "attack" then you can just detect the use of external entities. But of course external entities have many legitimate uses, and you will be preventing those too. If you're asking how you can distinguish malicious use of external entities from legitimate use, then I don't think you can. – Michael Kay Apr 1 '18 at 16:32
  • Indeed yes. Then perhaps I need more indicators of compromise to build an attack alarm. The string <!ENTITY * SYSTEM "*" > should probably be monitored but I'd like to understand if there are any further ways such attack could be detected then...any ideas? – ellefc Apr 1 '18 at 16:35
  • Searching for that regexp won't catch the Billion Laughs Attack. It's not the same attack, but certainly related. – Neil Smithline Apr 1 '18 at 17:13
  • Thinking a bit more deeply and with regards to the threat of sensitive information disclosure, detecting syntax which includes a URI that starts file:///etc/* would be highly indicative of an attack... – ellefc Apr 1 '18 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.