Cysinfo Talk on XML External Entity Attack

1. Web Application Security - Team bi0s © 2017
XXE
XML External Entity
25 February
2017
@Team bi0s 1/25
HEERAJ
Btech, Third Year, Computer Science
Engineering
Amrita University

2. whoami
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Undergraduate Student @ Amrita
➔ Web Security Enthusiast
➔ CTF{flag_seeker}
➔ @heerajnair
➔ ww.i4info.in
2/25

3. Agenda
Web Application Security - Team bi0s © 2017 @Team bi0s
➔Intro to XML & DTD
➔XML Entity
➔Parsing XML
➔Attack Vectors
➔Demo
3/25

4. XML
Web Application Security - Team bi0s © 2017 @Team bi0s
➔EXtensible Markup Language
4/25
Picture:123RF.COM

5. Where it is used ?
Web Application Security - Team bi0s © 2017 @Team bi0s
➔Document Formats
➔Image Formats
➔Configuration Files
➔Network Protocols
➔RSS Feeds … etc . . .
5/25
Picture: c-sharpcorner.com

6. Document Type Definition
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ References an External
DTD
➔ Define structure with the list of legal
elements
6/25

7. XML Entity
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Entities help to reduce the entry of
repetitive information
Output:
Writer: Donald Duck. Copyright: bi0s.
7/25

8. XML Entity
Web Application Security - Team bi0s © 2017 @Team bi0s
XML Entity
Internal Entity External Entity
8/25

9. Parsing
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Character other than < , > , & , ‘ , “ all are parsable.
➔ PCDATA is text that will be parsed by a parser.
➔ CDATA is text that will not be parsed by a parser.
◆ Ex : <![CDATA[<data>Hello, world!]]>
9/25

10. Attack’s Possible
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Denial Of Service
➔ Local File Inclusion
➔ SSRF
➔ Internal scans
➔ Rce (Not Always!!!)
10/25

11. Billion Laughs Attack
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Works by expansion property (Simple code(<1kb) will expand up to 3
gigabytes of memory.
11/25
Website: digitalimprint.com

12. Attack Vectors
Web Application Security - Team bi0s © 2017 @Team bi0s
Classic XXE
We can view any file which doesn’t contain < , > , & , ‘ , “ as characters.
12/25

13. 13

14. OFFICE OPEN XML
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Zip archive file containing XML and media files
➔ *.docx , *.xlsx , *.pptx
➔ Developed by Microsoft
14/25

15. OFFICE OPEN XML
Web Application Security - Team bi0s © 2017 @Team bi0s 15/25

16. OFFICE OPEN XML
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Files in OOXML
◆ /_rels/.rels
◆ [Content_Types].xml
◆ Default Main Document
● /word/document.xml
● /ppt/presentation.xml
● /xl/workbook.xml
16/25

17. Direct Feedback Channel
Web Application Security - Team bi0s © 2017 @Team bi0s
What if
you are Reading
Some configuration files?
17/25

18. Different Protocols
Web Application Security - Team bi0s © 2017 @Team bi0s 18/25
php://filter/convert.base64-encode/resource=/etc/passwd

19. Direct Feedback Channel
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ CDATA very helpful to read web configuration, which contain non
parsable characters.
But this won’t work !!
19/25

20. Direct Feedback Channel
Web Application Security - Team bi0s © 2017 @Team bi0s 20/25
1. XML Request
Parsing
Attacker’s Server
Host

21. Direct Feedback Channel
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ We have to use Parameter entities
➢ Parameter.dtd
21/25

22. Out Of Band Channel
Web Application Security - Team bi0s © 2017 @Team bi0s 22/25
1. XML Request
Parsing
Attacker’s Server
Host

23. Out Of Band Channel
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ No Direct Feedback Channel
23/25

24. Demo
Web Application Security - Team bi0s © 2017 @Team bi0s
XXE Cheat Sheet: http://web-in-security.blogspot.in/2016/03/xxe-cheat-sheet.html
24/25

25. Solution
Web Application Security - Team bi0s © 2017 @Team bi0s
➢ Validation of user input
➢ Turn off external DTD fetching
➢ Disable External Entity Parsing
libxml_disable_entity_loader(true);(PHP)
25/25

26. 26

27. Playing With Content Type
Web Application Security - Team bi0s © 2017 @Team bi0s
➔ Server may accept multiple data formats
➔ Results in Json endpoints may be vulnerable to XXE
➔ Content-Type changed to application/xml
➔ JSON has to be converted to XML
27/25

28. OFFICE OPEN XML
Web Application Security - Team bi0s © 2017 @Team bi0s 28/25
Open XML File Container
Document
Properties
Custom Defined
XML
Comments
WordML/
SpreadsheetML etc
Embedded
Code/Macros
Images, Video,
Sound Files
Charts