Questions tagged [xml]
XML (Extensible Markup Language) is a set of rules for encoding documents in both human-readable and machine-readable form. Use this tag for security issues relating to the format itself, or where the fact that the data is xml-formatted is core to the question.
78
questions
1
vote
0
answers
117
views
XXE OOB File Content Extraction
Currently, I've discovered an OOB XXE that allows me to include a .dtd file to extract a particular system file content, for instance, /sys/power/disk.
So my file.dtd is:
<!ENTITY % data SYSTEM &...
- 11
0
votes
0
answers
26
views
How XAdES protects against tampering if the certificate is embedded?
Signing XML file with XAdES extension provides the X509 certificate.
What is the security point if the certificate is given? Anyone can tamper the data with its own certificate, right?
I used to work ...
- 1
1
vote
0
answers
165
views
Extracting multiple lines out of band XXE [closed]
I was able to extract a line from the /etc/hostname file and also http://169.254.169.254/latest/meta-data/local-hostname but I want to extract the content of files with multiple line, such as the aws ...
- 111
1
vote
2
answers
431
views
Java XXE vulnerability
If I am already using
xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
then do I also need to use
xmlInputFactory.setProperty("javax.xml.stream.isSupportingExternalEntities",...
- 11
0
votes
2
answers
456
views
How does my HTTPS POST get blocked based on XML content?
There's a web application on a server which I have full access to which accepts POST requests on a REST endpoint. The request payload is expected to be an XML document. For request routing and load ...
- 121
1
vote
2
answers
405
views
What is an XML round trip vulnerability?
I keep hearing about the XML round trip vulnerability in version 3.2.4 of the Ruby package REXML. I looked into it myself, of course, and it seems to have something to do with parsing an XML document, ...
- 190
1
vote
1
answer
803
views
Blind XXE - Exfiltration Data via OOB
My lab
Kali Linux:192.168.171.134
bWApp Server: http://192.168.171.131
I want to do an exfiltration data via HTTP on this Blind XXE.
I'll use the Portswigger Payload.
This is the External.DTD:
&...
- 21
1
vote
1
answer
1k
views
XXE with OOB data exfiltration
SCENARIO:
I successfully tried to send a request to the burp collaborator, then the application is vulnerable to SSRF through blind XXE. The payload I used is the following
<?xml version="1.0&...
- 567
0
votes
2
answers
983
views
XXE Injection in docx: entity not defined
My goal is to create a docx file that, when uploaded to a server and parsed there, causes the parser to fetch my url so I know it worked.
Unfortunately, I only have Libre Office and not MS Office at ...
- 1
0
votes
1
answer
149
views
Bypassing Access-Control-Allow-Headers header [closed]
What i want to do is access the Content-type header which is placed under the Access-Control-Allow-Headers header as i want to attempt to change json to xml on a web application im working on to check ...
- 59
2
votes
1
answer
386
views
XML External Entity injection within the body of a document
If you Google for an example of XXE injection you get something like this:
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe ...
- 234
4
votes
1
answer
341
views
What's the use of an "extra" dynamic declaration in an external DTD blind XXE attack?
I've been studying XXE attacks through Portswigger's Web Security Academy. I stumbled upon a lab Exploiting blind XXE to exfiltrate data using a malicious external DTD.
In this lab an attacker has to ...
- 1,197
1
vote
1
answer
1k
views
Avoid cross site scripting in XML namespace
We have a legacy application on spring mvc and we have a web service exposed (SOAP protocol) for some reporting client app. This service was tested by a security team and the report indicates that the ...
1
vote
0
answers
215
views
CWE-611: Improper Restriction of XML External Entity Reference with XSL include
Veracode reports that the below code is susceptible to CWE-611: Improper Restriction of XML External Entity Reference.
XslCompiledTransform transform = new XslCompiledTransform();
transform.Load(...
- 143
0
votes
1
answer
474
views
Risks of allowing users to upload PDF and XML files to be stored/retrieved from a DB (ASPNET MVC 5)
I'm modifying an ASPNET MVC 5 web site and a requirement is to allow users to upload an XML and PDF file.
The XML file will be used to layout text on the PDF based on variables coming from within the ...
- 101
0
votes
1
answer
660
views
XXE - Encode file content
In my current assessment, I came across an XXE. Unfortunately, I cannot retrieve a bunch of files that would let me progress further (such as .bash_history and any other .xml/config files) because the ...
- 3
2
votes
1
answer
1k
views
Blind XSS Payload for xml file?
I think i may have found a blind XSS. I can only upload xml files that are opened inside the backend. My questions is: How can i turn this payload into a blind xss payload to receive a ping to my ...
- 41
6
votes
0
answers
2k
views
Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?
I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following ...
- 71
2
votes
1
answer
245
views
Does MathML pose a security risk?
MathML seems like a promising and attractive technology. But Google Chrome doesn't support it, allegedly because it has "architectural security issues" according this wikipedia page. But it also says "...
- 309
1
vote
1
answer
1k
views
SOAP Web Service: Basic Auth. vs Password in xml
I am testing a SOAP web service and the service sends username and password in every request as part of the XML body over SSL. I wanted to object to that and offer Basic Auth. but could not find any ...
- 700
0
votes
1
answer
414
views
Signature verification against custom CA [duplicate]
I need to (write a program to) verify signature in a (bunch of) signed XML files.
NOTE: I am dealing with XML files signed according to 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315', not just ...
- 217
0
votes
2
answers
342
views
Best way to encrypt user data stored in xml?
First of all I am not very familiar with the world of encryption so please be nice.
I have got a data that should store in an xml using NetDataContractSerializer. This xml file gets the size of from ...
- 1
8
votes
1
answer
4k
views
Is .NET XmlSerializer.Deserialize(TextReader) safe?
Is the .NET method XmlSerializer.Deserialize(TextReader) safe from XML vulnerabilities (XXE, XmlBomb etc..)? Will the DTD be processed during deserialization?
I can understand why XmlSerializer....
- 315
2
votes
1
answer
3k
views
How to avoid XML vulnerabilities in Python?
I am writing a suite of Python 3 applications (including first a command line utility, second an HTTP(S) proxy) which deal with XML.
Today I've discovered that there are several vulnerabilities ...
- 185
83
votes
6
answers
169k
views
Why would I ever use AES-256-CBC if AES-256-GCM is more secure?
I guess the gist of my question is: Are there cases in which CBC is better than GCM?
The reason I'm asking is that from reading this post by Matthew Green, and this question on cryptography stack ...
- 1,039
3
votes
2
answers
5k
views
What's the difference between an API gateway and XML gateway?
I'm studying for the CCSP exam and am confused on the difference between an "API gateway" and "XML gateway". The training material I have states:
API gateways are also an important part of a ...
- 3,428
2
votes
0
answers
389
views
How can XML External Entity attacks be detected?
XML External Entity attacks have been identified as an OWASP top 10 web application vulnerability. Whilst there seems to be extensive information on what an XML external entity attack is and how it ...
- 509
-2
votes
1
answer
3k
views
Can an XXE attack be carried out from within an docx file? [closed]
Is XXE possible in a file upload with .docx files?
1
vote
0
answers
203
views
Example of Insecure DTD Processing in XmlSchema.Read
According to https://msdn.microsoft.com/en-us/library/mt661872.aspx and https://github.com/dotnet/roslyn-analyzers/issues/563 the code below is vulnerable to DTD expansion attack:
var src = "?...
1
vote
1
answer
1k
views
Difference between XML external entities and Remote File Inclusion attacks
I was just studying about the XML external entities attack and Remote File Inclusion Attack.
According to my understanding, the XML external entities attack is where the XML parser in the web ...
- 608
1
vote
0
answers
2k
views
Private key to sign a XML file
I’ve never dealt with cryptography before so my question may be sound trivial.
I need to create an app that sends messages as digitally signed XML files.
The messages are sent to a CA entity.
...
- 11
12
votes
4
answers
7k
views
Execute a PHP function that returns an array from an XSL file
There is a security challenge where you have to execute code on the server to retrieve a flag, and this code has to be executed using an XSL document.
So I found a way to make the server interpret my ...
- 669
1
vote
0
answers
771
views
Mitigating - Microsoft XML Parser (MSXML) and XML Core Services Unsupported (62758)
We have a number of host that are running an outdated and now unsupported version of MS XML Parser\Core Services. I am trying to find a way to mitigate this issue silently on workstations, hopefully ...
- 11
2
votes
3
answers
342
views
What is the purpose of encrypting a symetric key with a public key in XML EncryptedKey?
I was reading the XML Encryption standard and I have some trouble understanding the purpose of encrypting some plain text with a symmetric generated AES or 3DES key that in turn gets encrypted with ...
- 121
5
votes
1
answer
2k
views
How does SAML signature exchange work between IDP and SP?
I'm trying to understand the SAML protocol 2.0 (signed) exchange.
Here is what I understood so far:
IDP has its own public (PB1) and private (PV1) pair
SP has its own public (PB2) and private (PV2)...
- 151
3
votes
1
answer
1k
views
Any vulnerabilities from shorting browser's XML parser?
I have found a way of forcing a site to return content-type XML to the user's browser even though the content is HTML. The browser then interprets this site as XML and throws an error since the HTML ...
- 105
3
votes
1
answer
650
views
Why is this XPATH injection attack failing, and what is going on in the background of attack?
Hi I'm trying to understand XPATH injection, got a loacl ctf issue and cant seem to understand how it works. So this is the query:
555-555-555=true
After fuzzing parameters I get:
Description: ...
- 1,442
1
vote
0
answers
1k
views
Java XXE Injection - Billion Laughs doesn't work
I'm trying to reproduce several xxe attacks against a java web service.
When i try to reproduce "Billion Laughs"
i always get this:
Exception in thread "main" org.xml.sax.SAXParseException; ...
- 131
12
votes
1
answer
3k
views
Is PHP loadXML vulnerable to XXE attack (and to other attacks)? Is there a list of vulnerable functions?
I have PHP code that uses the loadXML function (as well as other XML functions).
Is the loadXML function vulnerable to XXE attack? Namely, if the XML contains external entities, will they be ...
- 485
1
vote
0
answers
405
views
AES256 key exchange
I'm trying to get a secure way of exchanging keys between my client application and the server.
The goal is to encrypt all XML messages with AES256. These XML's will be transferred to the server ...
- 11
2
votes
0
answers
498
views
cross-domain.xml file: Different policies in different directories
I came across cross-domain xml files on Vimeo and found that there are different policies on different directories.
One on https://vimeo.com/settings/crossdomain.xml
<?xml version="1.0" encoding="...
- 1,791
2
votes
1
answer
220
views
Are browsers fetching the XSLT namespace over HTTP when transforming XML?
According to the W3C recommendation (and according to W3C Schools), an XSL style sheet using XSLT should be declared as follows:
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/...
- 23
1
vote
1
answer
839
views
Fuzzing C++ application that expects XML file
I'm trying to fuzz an application to make sure it is secure. The app does not have any UI and needs to be run via the cmdline:
app.exe myfile.xml
Also myfile.xml looks like this:
<Sample>
<...
- 11
3
votes
1
answer
587
views
Single Page Application with REST API backend based on XML, queried by dynamic XPath
A web application I'm developing will be a Single Page Application (SPA) that will interact with a REST API backend, through jQuery.ajax() calls.
The SPA and API will both be served over an https/TLS ...
- 133
3
votes
1
answer
2k
views
Can an XXE (XML External Entity) attack be carried out from within an SVG file?
Since SVG is built heavily if not entirely on XML, can one of the attacks that can be carried out through XML such as XXE injection be carried out from an SVG file?
- 33
4
votes
1
answer
863
views
Approach for testing XXE injection
I have been discussing xxe injection in my web application,My web application allows expansion of user-supplied XML entities
What i did:
Intercepted traffic using Burp.
Changed the request with ...
- 5,097
11
votes
4
answers
2k
views
Is this a weakness of enveloped XML signature?
There might be a problem in many applications based on XML signature verification (provided I am not wrong, of course).
Let's have a simple XML message with an enveloped XML signature:
<?xml ...
- 356
38
votes
8
answers
8k
views
How to know whether a textfile has been edited or tampered with?
Is it possible to know whether a textfile, e.g. in XML format, has been edited or tampered with over time?
The context to my question follows:
I am a scientist in industry using a technology called ...
- 507
0
votes
1
answer
253
views
Collect XML files from web server with secure authentication
I need to collect XML files from a 3rd party's web server.
These XML files are generated by said 3rd party on a daily basis (e.g. data_2015-11-26.xml) and should therefore be fetched at least daily ...
- 3
66
votes
3
answers
19k
views
Why do email programs block xml files?
A colleague sent a .xml file to me earlier today, which was blocked by Outlook. As we were discussing the workaround (put it in a .zip), we got to wondering why .xml files are blocked.
My colleague ...
- 695