1

Our application is using loadXML extensively to recieve data(input) from the users. Other than the usual checks for SQL injections and XXS, are there any known risks in parsing the xml file using loadXML? The XML files are limited in size and will be under 2MB.

Could someone potentially create an XML files with a malicious macro?

https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing https://www.owasp.org/index.php/Testing_for_XML_Injection_(OWASP-DV-008)

I read these links but I am not sure if we could safely rely on loadXML or not? If not, what methods should we use to sanitize or validate an xml as safe?

|improve this question
  • At the very least, a 2MB XML length limit offers an attacker lots of leverage to create a file that will take much, much more memory on your server. Possibly enough to turn it in a denial of service attack. – Bruno Rohée Jul 15 '14 at 15:04
  • Could you offer an example? Do you mean by using macros? – wolfdawn Jul 16 '14 at 10:11
  • 1
    No need for macros, you can just optimize a valid document for maximized memory footprint, lots of one letter tags and attributes will do it. A valid XML header followed by <a><a><a><a> x 100,000 followed by </a></a></a></a> x 100,000 is valid XML and often has a huge memory footprint. If you look for stuff in the document it could possibly take a very long time too. – Bruno Rohée Jul 16 '14 at 12:08
  • How do I check the memory footprint of an xml file? – wolfdawn Jul 16 '14 at 12:10
  • It's hard to do, you can however makes an example program that parses it and observe its memory usage. – Bruno Rohée Jul 16 '14 at 12:12
2

for XXE please read:

i can confirm a similar attack worked on Java/Tomcat

And then there is a Billion Laugh - Attack ( i think this was what Bruno referred to)

|improve this answer
1

The way we decided to address XML expansion and XXE vulnerabilities is to search for the !ENTITY and !DOCTYPE substring in the XML. If they exist, the XML was sent by an attacker because they are not sent by the application. We also decided to count < and > in order to protect from an attack like @Bruno Rohée suggested and only parse the document if the amount of these is bellow a safe threshold.

I believe we are somewhat protected now.

|improve this answer
  • Is there any way to insert the !ENTITY and !DOCTYPE and have them undetected by a simple string search? – wolfdawn Jul 16 '14 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.