XXE
Introduction
The XML External Entity (XXE) Processing attack is a type of attack that allows an attacker to interfere with an application's processing of XML data. This XML data contains a reference to an external entity (A system file or external URL) that is processed by the XML parser, leading to information disclosure, server-side request forgery and port scanning.
Proof of Concept
The following examples retrieve the file /etc/passwd from the victim system and show its content inside the "name" attribute.
Furthermore, it can also be used to perform SSRF attacks:
Finally, if the application allows SVG images to be uploaded. So, since the SVG format uses XML, the image processing library might analyze the image, obtaining a new attack surface.
Once the image is shown to the client, it will contain the retrieved information.
Blind XXE (Data out-of-band)
In a blind XXE attack, the attacker can not see the result of their injection and must rely on indirect methods to gather information or execute their payload.
To perform this attack, first, the attacker must host a malicious Document Type Definition (DTD) on their attacking machine and then invoke the malicious DTD from the DTD that is sent to the victim's website.
This is an example of retrieving the file /etc/password from the victim's website.
Blind XXE (Error message)
Another alternative to retrieve data using an XXE vulnerability is by triggering an XML parsing error, only will work if the application shows the resulting error message within the response, where the error message will contain the sensitive data that you want to retrieve.
The payload would be:
References
Last updated