XML EXTERNAL ENTITIES (XXE) INJECTION ATTACK

Week Five ↓

TL;DR
According to Open Web Application Security Project (OWASP), XXE Injection, a type of attack against an application that parses XML input, was one of the top 10 web application security risks in 2017. There are certain consequences that could result from this risk. We also look at how to detect and mitigate this risk.

XML External Entities (XXE) injection also known as XXE injection attack is a form of attack that is based on Server-Side Request Forgery (SSRF). A successful XXE injection attack can cause a lot of harmful damage or consequence to businesses and also to the web application or website running on XML, thereby potentially leading to Denial of Service (DoS) attack with recursive entity expansion, access to local, remote content through file upload functionality, hijack of services running on the server application, remote code execution, port scanning in some advanced cases, ability for the attacker to run operating system level commands. XML External Entities injection abuses XML parsers feature available in the application (Infosec, 2018). The keyword ‘SYSTEM’ in the code for the XML allows for reading of data from the Universal Resource Identifier (URI) and permits it to be substituted in the document thereby allowing the attacker or malicious user of the application to craft his own special payload through the entity and make the application display it. In order words, this kind of attack allows the attacker to create special payload to force the XML parser in the application to access specified resources; be it a file or remote code execution (Muscat, 2019). Attackers can also use it to steal source code of an application, get directory listing of local resource content. It can also allow attacker to make HTTP requests to files on the local network.

 

We take a look at how external entries can be use for data Remote Code Execution (RCE) and Data Exfiltration from a vulnerable system.

Remote Code Execution

If the PHP "expect" module is loaded, we can get RCE.

<?XML version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [ <!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "expect://id" >]>
<creds>
    <user>&xxe;</user>
    <pass>mypass</pass>
</creds>

The server responds with:

You have logged in as user uid=0(root) gid=0(root) groups=0(root)

Data Exfiltration

System files can be read in the context of permissions that have been assigned to the vulnerable application. The request below would be used to read system files by using external entity. In the payload, the “protocol type” is abused.

(Infosec, 2018)

“file://” is used to replace “http://” and system files are read as below.

(Infosec, 2018)

CONSEQUENCES OF XXE ATTACK

XXE Injection could lead to the following;

·         Remote command execution.

·         Ability to scan ports locally.

·         Server-side Requests Forgery.

·         Client-side Request Forgery.

·         Local file disclosure.

·         Scanning of internal host network.

LIMITATIONS WORKAROUND

Attackers find accessing text files on with XML-like content a challenge but various workarounds have been discovered and developed over the years. These include;

·         Character Data (CDATA).

·         Parameter Entities.

·         Php Protocol Wrappers.

HOW TO DETECT XML EXTERNAL ENTITIES (XXE) VULNERABILITES

XML External Entities attack is a dangerous attack in which if attackers could exploit the vulnerability could lead to serious damage. When it was first featured on the Open Web Application Security Project (OWASP) top 10 list of vulnerabilities in the year 2017, it came up on the number 4 spot. That is quite remarkable considering that it was a quite new vulnerability. High severity consequences could result from this attack and so should be treated as major security risks (Muscat, 2019).

This XML External Entities Injection vulnerability is easy to spot or detect on the web application or website. This can be done by;

·         Running an automated XML External Entities Scanner on the web application or website.

·         Running vulnerability scanners like; Nessus, Burp Suite scanner, Acunetix scanner on the web

application or website.

·         Manual testing of the web application or website by the web application administrator or

server administrator.

HOW TO PREVENT AGAINST XML EXTERNAL ENTITES INJECTION ATTACK

Protecting against XML external entities attack on the web application or website is paramount. Going by Open Web Application Security Project (owasp) general guidance on XML External Entities injection prevention, the safest way to prevent against XXE attack is to always disable DTDs (Document Type Declaration) completely (Infosec, 2018). This helps in mitigating and securing against denial of service (DoS) such as Billion Laughs.

Also, since the XML document is sent from an untrusted client, there has to be a way to selectively validate and escape tainted data. Firewalls can be used in preventing against XML External Entities injection. These firewalls scan the website or web application regularly and uses signatures in its database to match against any known XML External Entities request and mitigates them.

Using scanner tools specially designed for XML external entities help to check and mitigate this risk. The tools scan the web application or website and recommends or in some cases fix the vulnerabilities that has been discovered in the application.

REFERENCES

Infosec. (May, 2018). Finding and Exploiting XXE-XML External Entities Injection. Retrieved from https://resources.infosecinstitute.com/finding-and-exploiting-xxe-xml-external-entities-injection/#gref

Muscat, I. (March, 2019). What are XML Enternal Entity (XXE) Attacks. Retrieved from https://www.acunetix.com/blog/articles/XML-external-entity-xxe-vulnerabilities/

Video Credit: HackHappy. December 18, 2018