3

I am trying to understand the concept behind XXE (XML External Entity injection). I went through OWASP Guidelines on XXE

And since I am new to XML and DTD, I went through the W3Cschools tutorials as well on these topics. Now as per my readings I tried creating a demo of XXE. So below is my attempt to do the same : -

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE note [
<!ELEMENT note (to,from,heading,body,author)>
<!ELEMENT to (#PCDATA)>
<!ELEMENT from (#PCDATA)>
<!ELEMENT heading (#PCDATA)>
<!ELEMENT body (#PCDATA)>
<!ENTITY writer "Donald Duck.">
<!ENTITY copyright "Copyright W3Schools">
<!ENTITY attack SYSTEM "file:///Users/testuser/Desktop/BB/demos/test.txt">
]>
<note>
<to>Tove</to>
<from>Jani</from>
<heading>Reminder</heading>
<body>Don't forget me this weekend</body>
<author>&writer;&copyright;&attack;</author> 
</note>

And in the path

file:///Users/testuser/Desktop/BB/demos/

I have a file test.txt that contains a string say :-

this is secret stuff

Now, when I open my XML file in Firefox it gives me the tree structure of my XML document and as expected it expands the entities writer and copyright with their respective content as defined in the DTD. However, the XML parser did not expand the entity "attack", which should have happened as has been demonstrated in the link given above.

Now I would like to know why was the entity attack not expanded. And secondly, even if it were expanded, will the file permissions (of the local file system) not come into play here?

Improve this question
4
  • Firefox probably either doesn’t support expansion of external entities or it’s disabled. However, XXE is a server-side attack as you would want to read arbitrary files from the remote server and not from your local machine.
    – Gumbo
    Jan 5, 2014 at 12:40
  • @Gumbo is there a way to enable expansion of external entity in FF. And yes I do understand that XXE will primarily be used to access files on a remote server. It is just for the sake of teaching my self that I am trying to read a local file here. Hey and thanks, this works. I should have tried it earlier itself. Opening the same XML file in OPERA does the job.
    – qre0ct
    Jan 5, 2014 at 12:47
  • Ok, it was browser issue. The same XML file when opened in Opera does the required stuff.
    – qre0ct
    Jan 5, 2014 at 12:49
  • XXE is also an issue in desktop apps that process XML data. It can lead to escapes of apps' internal sandboxes, and it has in the past in Acrobat Reader.
    – Steve Dodier-Lazaro
    May 11, 2015 at 0:46

2 Answers 2

Reset to default
2

Just to flesh this out a little past your original point about browsers.

Usually XXE is an attack on the server-side, so a user viewing the site can get access to files outside of the webroot, to which they would not normally have access.

The access and impact of the XXE depends on whether there are useful files findable by the attacker and also the permissions of the user running the web application. The kind of things that could prove particularly problematic are configuration files in predictable locations which contain usernames/passwords which allow the attacker to get additional access (e.g. a file providing credentials for a management application)

There is also the theoretically possibility to turn this into remote file inclusion as the spec. supports the concept of a remote external entity (i.e. pull back the contents of a file from a remote server and process them into the document), but I've never seen that implemented in practice.

In terms of mitigation this is usually done at the level of the XML parser and the easiest fix is to disable entity expansion, unless it is specifically required for the functioning of the application (rarely a requirement from what I've seen). If it is needed then input validation/encoding is likely to be the correct approach to fixing it.

Improve this answer
0
2

If your running linux, there's an XML parser, xmllint. You may use it to parse xml documents, and to expand entity references use --noent option.
For example:

xmllint --noent xxe.xml

And, yes. The file permission does come into play. If you don't have sufficient permission to read the file, you'll encounter an error.

For example, assuming you're on a linux machine, if you replace
file:///Users/testuser/Desktop/BB/demos/test.txt
with
file:///etc/shadow
you get an error. You may, then, run above command with sudo to get the contents of etc/shadow file.

I hope it helps, at least to others who might visit this :)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .