Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [xxe]

XXE, or XML External Entity, is part of the XML spec that can introduce a vulnerability in poorly crafted XML parsers.

0
votes
0answers
6 views

Resolving XML External Entity Defect in message audit service?

A corporate code analysis tool identified a security vulnerability in a web service that my team maintains. It identified an XXE (XML External Entity) vulnerability in this service and referenced the ...
1
vote
0answers
184 views

ASP.NET SOAP Service XXE

Is it possible to do any type of XXE in a service developed using default C# SOAP service framework? I ask because any type of XXE payload I try to add, even XML header, whatever I add before SOAP ...
1
vote
1answer
66 views

Exfiltration through FTP using XXE on a Tomcat server

I'm trying to extract binary data from a Tomcat server that is using SAXParser. For my FTP server, I am using this source. I'm hosting two DTD's on Github Gist. These are their contents: Base XML (...
0
votes
1answer
87 views

Why do we need External dtd in blind XXE?

A proper blind XXE payload is:- <?xml version="1.0" ?> <!DOCTYPE r [ <!ELEMENT r ANY > <!ENTITY % sp SYSTEM "http://127.0.0.1/dtd.xml"> %sp; %param1; ]> <r>&exfil;&...
0
votes
0answers
165 views

XXE injection in root node of XML document

So I'm on an engagement and discovered an XXE injection point in a peculiar place on a ASP.NET app that I can't seem to get my head around. One of the post parameters controls what "form" the rest of ...
1
vote
1answer
314 views

Is .NET XmlSerializer.Deserialize(TextReader) safe?

Is the .NET method XmlSerializer.Deserialize(TextReader) safe from XML vulnerabilities (XXE, XmlBomb etc..)? Will the DTD be processed during deserialization? I can understand why XmlSerializer....
1
vote
1answer
212 views

attack path alternatives for XXE

So I've found a blind Xml External Entity (XXE) attack against a SAML infrastructure while on a client engagement but it has been giving me fits trying to exploit it earlier. I can construct a simple ...
1
vote
1answer
104 views

Why isn't XXE part of Injection in the OWASP Top 10?

I'm trying to explain to myself why XXE doesn't fall under the Injection category, as it is a form of XML injection. XML External Entity is an attack that manipulates the XML parser/interpreter, to ...
-2
votes
1answer
562 views

Can an XXE attack be carried out from within an docx file? [closed]

Is XXE possible in a file upload with .docx files?
1
vote
0answers
56 views

Example of Insecure DTD Processing in XmlSchema.Read

According to https://msdn.microsoft.com/en-us/library/mt661872.aspx and https://github.com/dotnet/roslyn-analyzers/issues/563 the code below is vulnerable to DTD expansion attack: var src = "?...
1
vote
1answer
837 views

XSS and XXE payload in XML attributes value

I am testing web application with functionality of file upload. The only possible file format is XML. The content of the file saved in XML attributes is then presented on the separate page. For ...
7
votes
1answer
1k views

Preventing XSS in SVG

Currently assessing an application, I found out that it is possible to submit an SVG fill containing Javascript (the app is also vulnerable to XXE). I wondered if there was a method to prevent those ...
3
votes
1answer
357 views

Any vulnerabilities from shorting browser's XML parser?

I have found a way of forcing a site to return content-type XML to the user's browser even though the content is HTML. The browser then interprets this site as XML and throws an error since the HTML ...
1
vote
0answers
692 views

Java XXE Injection - Billion Laughs doesn't work

I'm trying to reproduce several xxe attacks against a java web service. When i try to reproduce "Billion Laughs" i always get this: Exception in thread "main" org.xml.sax.SAXParseException; ...
12
votes
1answer
2k views

Is PHP loadXML vulnerable to XXE attack (and to other attacks)? Is there a list of vulnerable functions?

I have PHP code that uses the loadXML function (as well as other XML functions). Is the loadXML function vulnerable to XXE attack? Namely, if the XML contains external entities, will they be ...
3
votes
1answer
1k views

Can an XXE (XML External Entity) attack be carried out from within an SVG file?

Since SVG is built heavily if not entirely on XML, can one of the attacks that can be carried out through XML such as XXE injection be carried out from an SVG file?
4
votes
0answers
704 views

Approach for testing XXE injection

I have been discussing xxe injection in my web application,My web application allows expansion of user-supplied XML entities What i did: Intercepted traffic using Burp. Changed the request with ...
2
votes
1answer
592 views

XML external entity - Local file enumeration (Impact assessment question)

I had come across an XML request-response pair while testing a web application and attempted to inject XXE payloads. Note that in this case no XML parameter sent in the request was getting reflected ...
1
vote
1answer
2k views

What are steps to defend against XML External Entity (XXE) Processing vulnerability?

Lately I've seen so many attacks of this type, so I wanted to ask what is the proper way to defend against XML External Entity (XXE) Processing vulnerability. For example what if I parse some simple ...