Java org.xmlpull.v1.XmlPullParser and XML External Entity (XXE) Processing Attacks

Question

I'm evaluating the security of an Android application and the application is using the XmlPullParser included with Android.

I'm having some difficulty getting any common attacks to work, but I want to be sure I haven't missed any possibilities. What are the minimum requirements/features this parser needs to have enabled for XXE processing attacks to be successful?

In particular I am looking at whether the features for XmlPullParser.FEATURE_PROCESS_NAMESPACES and XmlPullParser.FEATURE_PROCESS_DOCDECL are enabled or not.

Answer 1

Well I can answer my own question now, at least in part.

The application I was examining has a default instance of XmlPullParser with only FEATURE_PROCESS_NAMESPACES disabled. I was able to get the Billion Laughs entity attack to work. My issue what I was not putting the entity in the right child element of the expected XML response.