XXE - XML External Entity

An XML External Entity attack is a type of attack against an application that parses XML input and allows XML entities. XML entities can be used to tell the XML parser to fetch specific content on the server.

Internal Entity: If an entity is declared within a DTD it is called as internal entity. Syntax: <!ENTITY entity_name "entity_value">

External Entity: If an entity is declared outside a DTD it is called as external entity. Identified by SYSTEM. Syntax: <!ENTITY entity_name SYSTEM "entity_value">

Summary

  • Tools

  • Detect the vulnerability

  • Exploiting XXE to retrieve files

    • Classic XXE

    • Classic XXE Base64 encoded

    • PHP Wrapper inside XXE

    • XInclude attacks

  • Exploiting XXE to perform SSRF attacks

  • Exploiting XXE to perform a deny of service

    • Billion Laugh Attack

  • Error Based XXE

  • Exploiting blind XXE to exfiltrate data out-of-band

    • Blind XXE

    • XXE OOB Attack (Yunusov, 2013)

    • XXE OOB with DTD and PHP filter

    • XXE OOB with Apache Karaf

  • Windows Local DTD and Side Channel Leak to disclose HTTP response/file contents

  • XXE in exotic files

    • XXE inside SVG

    • XXE inside SOAP

    • XXE inside DOCX file

    • XXE inside XLSX file

    • XXE inside DTD file

  • XXE WAF Bypass via convert character encoding

Tools

  • xxeftp - A mini webserver with FTP support for XXE payloads

  • 230-OOB - An Out-of-Band XXE server for retrieving file contents over FTP and payload generation via http://xxe.sh/

  • XXEinjector - Tool for automatic exploitation of XXE vulnerability using direct and different out of band methods

  • oxml_xxe - A tool for embedding XXE/XML exploits into different filetypes (DOCX/XLSX/PPTX, ODT/ODG/ODP/ODS, SVG, XML, PDF, JPG, GIF)

  • docem - Utility to embed XXE and XSS payloads in docx,odt,pptx,etc

  • otori - Toolbox intended to allow useful exploitation of XXE vulnerabilities.

Detect the vulnerability

Basic entity test, when the XML parser parses the external entities the result should contain "John" in firstName and "Doe" in lastName. Entities are defined inside the DOCTYPE element.

It might help to set the Content-Type: application/xml in the request when sending XML payload to the server.

Exploiting XXE to retrieve files

Classic XXE

We try to display the content of the file /etc/passwd

⚠️ SYSTEM and PUBLIC are almost synonym.

Classic XXE Base64 encoded

PHP Wrapper inside XXE

XInclude attacks

When you can't modify the DOCTYPE element use the XInclude to target

Exploiting XXE to perform SSRF attacks

XXE can be combined with the SSRF vulnerability to target another service on the network.

Exploiting XXE to perform a deny of service

⚠️ : These attacks might kill the service or the server, do not use them on the production.

Billion Laugh Attack

Yaml attack

Error Based XXE

Payload to trigger the XXE

Contents of ext.dtd

Exploiting blind XXE to exfiltrate data out-of-band

Sometimes you won't have a result outputted in the page but you can still extract the data with an out of band attack.

Blind XXE

The easiest way to test for a blind XXE is to try to load a remote resource such as a Burp Collaborator.

Send the content of /etc/passwd to "www.malicious.com", you may receive only the first line.

XXE OOB Attack (Yunusov, 2013)

XXE OOB with DTD and PHP filter

XXE OOB with Apache Karaf

CVE-2018-11788 affecting versions:

  • Apache Karaf <= 4.2.1

  • Apache Karaf <= 4.1.6

Send the XML file to the deploy folder.

Ref. brianwrf/CVE-2018-11788

XXE with local DTD

In some case, outgoing connections are not possible from the web application. DNS names might even not resolve externally with a payload like this:

If error based exfiltration is possible, you can still rely on a local DTD to do concatenation tricks. Payload to confirm that error message include filename.

Assuming payloads such as the previous return a verbose error. You can start pointing to local DTD. With an found DTD, you can submit payload such as the following payload. The content of the file will be place in the error message.

Other payloads using different DTDs

Windows Local DTD and Side Channel Leak to disclose HTTP response/file contents

From https://gist.github.com/infosec-au/2c60dc493053ead1af42de1ca3bdcc79

Disclose local file

Disclose HTTP Response:

XXE in exotic files

XXE inside SVG

Classic

OOB via SVG rasterization

xxe.svg

xxe.xml

XXE inside SOAP

XXE inside DOCX file

Format of an Open XML file (inject the payload in any .xml file):

  • /_rels/.rels

  • [Content_Types].xml

  • Default Main Document Part

    • /word/document.xml

    • /ppt/presentation.xml

    • /xl/workbook.xml

Then update the file zip -u xxe.docx [Content_Types].xml

Tool : https://github.com/BuffaloWill/oxml_xxe

XXE inside XLSX file

Structure of the XLSX:

Extract Excel file: 7z x -oXXE xxe.xlsx

Rebuild Excel file:

Add your blind XXE payload inside xl/workbook.xml.

Alternativly, add your payload in xl/sharedStrings.xml:

Using a remote DTD will save us the time to rebuild a document each time we want to retrieve a different file. Instead we build the document once and then change the DTD. And using FTP instead of HTTP allows to retrieve much larger files.

xxe.dtd

Serve DTD and receive FTP payload using xxeserv:

XXE inside DTD file

Most XXE payloads detailed above require control over both the DTD or DOCTYPE block as well as the xml file. In rare situations, you may only control the DTD file and won't be able to modify the xml file. For example, a MITM. When all you control is the DTD file, and you do not control the xml file, XXE may still be possible with this payload.

XXE WAF Bypass via convert character encoding

In XXE WAFs, DTD Prolog are usually blacklisted BUT not all WAFs blacklist the UTF-16 character encoding All XML processors must accept the UTF-8 and UTF-16 encodings of Unicode -- https://www.w3.org/XML/xml-V10-4e-errata#E11 we can convert the character encoding to UTF-16 using iconv to bypass the XXE WAF:-

References

PreviousSAML InjectionNextXSS - Cross Site Scripting

Last updated