Module 11: XML External Entities
Introduction to XML
XML Entities
A data structure containing valid XML code that will be referenced multiple times in a document. Think of it like a placeholder for content. Similar to variables in programming.
Internal Entities
Internal entities are locally defined within the DTD.
A sample DTD declaration
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE name [
... one or more entities ...
]>The format of an internally parsed entity
<!ENTITY name "entity_value">Example of internal entity syntax
<!ENTITY test "<entity-value>test value</entity-value>">External Entities
External entities are used when referencing data not defined locally within an XML document. They can be split into private and public groups.
The format of a privately parsed external entity
Example of private external entity syntax
The format of a publicly parsed external entity
Example of public external entity syntax
Parameter Entities
These exist solely within a DTD.
The format of a parameter entity
An example of a parameter entity
Understanding XML External Entity Processing Vulnerabilities
An XML External Entity (XXE) injection is a specific type of attack against XML parsers — the attacker forces the parser to process one or more external entities, resulting in the disclosure of confidential information not normally accessible by the application.
Testing for XXE
Retrieving Files
An external entity example
Error-based Testing
Utilize the errors to store data in the database, or in-band exfiltration.
Out-of-Band Testing
Using another server in a server-side request forgery attack, or as a means to exfiltrate data back to a server we control.
External entity with an HTTP URL
Case Study: Apache OFBiz XXE Vulnerability
Accessing Apache OFBiz
Start the VPN, VM, and add its IP to your hosts file.
Discovery
Sample Product XML
Restructured Product XML
Base XXE payload
Exploitation
Updated XXE payload with external entity
Error-Based Exploitation
Updated payload with "createdStamp" element
Updated payload with the external entity reference in the "description" element
Error message excerpt from Burp Suite
Out-of-Band Exploitation
Sometimes we can't access the results of our XXE attack or obtain verbose errors, thus we can try out-of-band XXE attacks. We must create and host our own DTD file that contains two entities.
Contents of external.dtd
Starting Apache
Updated XML payload using the external DTD file
Illegal character in URL Error Message
access.log contents
Updated external.dtd
Requests for external.dtd and the exfiltrated data
Last updated