1

I've been reading up on XXE Injection, and so far every example I've seen has involved a webserver voluntarily loading xml external entities (as below).

<?php 
libxml_disable_entity_loader (false); 
$xmlfile = file_get_contents('php://input'); 
$dom = new DOMDocument(); 
$dom->loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD); 
$creds = simplexml_import_dom($dom); 
$user = $creds->user; 
$pass = $creds->pass; 
echo "You have logged in as user $user";?>

Given the risk of XXE Injection attacks and the possibility for those attacks to a) disclose confidential information and/or b) perform remote code execution (RCE), why would a web server developer/admin decide to enable loading external xml entities in the first place?

So far I haven't seen any explanation for what the motivation is to enable loading external xml entities. Is it just lazy coding? Ignorance? Convenience?

4
  • Loading data from the client or partner services?
    – schroeder
    Jul 17, 2019 at 15:59
  • 1
    There are many, many reasons why. Some are actually legitimate reasons from a security standpoint. "Why allow XXE in general" is too broad to answer here, "Why does [foo] allow XXE in [bar]" is unanswerable unless we get a testimonial from the developers, and "Why allow blatantly insecure code" is opinion based and doesn't lead to a useful answer.
    – Ghedipunk
    Jul 17, 2019 at 16:02
  • 1
    Rather, this topic would probably get much more attention and constructive answers if you could find a way to rephrase it to a "how" question rather than a "why" question... or find a "why" question that touches on details of how XXE works, or why tutorials use explicit XML entities loading as their one example, rather than on the decisions of people who might leave XXE vulnerabilities in their systems.
    – Ghedipunk
    Jul 17, 2019 at 16:05
  • That's not a web server loading data. That's a server-side web application loading data.
    – user
    Jul 17, 2019 at 19:46

1 Answer 1

1

why would a web server developer/admin decide to enable loading external xml entities in the first place?

Usually this is not about explicitly enabling but about not being aware of the problem and using a library with insecure default settings. Many libraries have or had loading of external entities enabled by default. To cite from OWASP XML External Entity Prevention Cheat Sheet:

... starting with libxml2 version 2.9, XXE has been disabled by default

Which means before that it was enabled

... libxerces-c ... Use of XercesDOMParser do this to prevent XXE ... Use of SAXParser, do this to prevent XXE ... Use of SAX2XMLReader, do this to prevent XXE ...

Which suggests that it is enabled by default

... the default settings for most Java XML parsers is to have XXE enabled.

and there are more libraries in this document which have XXE enabled by default.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .