From e0da79394eb97a51ebe39dbc71ddc1e917880186 Mon Sep 17 00:00:00 2001 From: PiranhaSa Date: Thu, 28 Dec 2023 11:51:50 +0100 Subject: [PATCH] Adding XXE injection entry --- .../description.md | 46 ++++++++++++++++ .../XML_EXTERNAL_ENTITY_INJECTION/meta.json | 24 ++++++++ .../recommendation.md | 55 +++++++++++++++++++ 3 files changed, 125 insertions(+) create mode 100644 WEB_SERVICE/WEB/_CRITICAL/XML_EXTERNAL_ENTITY_INJECTION/description.md create mode 100644 WEB_SERVICE/WEB/_CRITICAL/XML_EXTERNAL_ENTITY_INJECTION/meta.json create mode 100644 WEB_SERVICE/WEB/_CRITICAL/XML_EXTERNAL_ENTITY_INJECTION/recommendation.md diff --git a/WEB_SERVICE/WEB/_CRITICAL/XML_EXTERNAL_ENTITY_INJECTION/description.md b/WEB_SERVICE/WEB/_CRITICAL/XML_EXTERNAL_ENTITY_INJECTION/description.md new file mode 100644 index 00000000..97ac1a64 --- /dev/null +++ b/WEB_SERVICE/WEB/_CRITICAL/XML_EXTERNAL_ENTITY_INJECTION/description.md @@ -0,0 +1,46 @@ +XXE (XML External Entity) injection is a critical security flaw that arises when an application parses XML input from untrusted sources without proper validation. Attackers exploit this vulnerability by injecting external entities into the XML data, potentially leading to unauthorized access to sensitive files or directories on the server, such as /etc/passwd. This breach can enable adversaries to extract confidential information, disrupt application functionality, or execute arbitrary code. XXE vulnerabilities commonly occur due to lax input validation and the misconfiguration of XML parsers, allowing malicious entities to manipulate XML structures. +### Examples + +#### Java + +```java +//Input example : +String xmlInput = "\n" + + "]>\n" + + "&xxe;"; + +DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); +DocumentBuilder builder = factory.newDocumentBuilder(); +Document doc = builder.parse(new ByteArrayInputStream(xmlInput.getBytes())); + +// Process the XML document +// Access the parsed data, which could potentially include sensitive information +``` + +#### Javascript + +```javascript +const app = require("express")(); +const libxml = require("libxmljs"); +app.post("/path", (req, res) => { + Element = libxml.parseXml(req.body, { noent: true }); + // Processing the XML element +}); +``` + +#### Php + +```php + +]> +&xxe;'; + +$doc = new DOMDocument(); +$doc->loadXML($xmlInput); + +echo $doc->saveXML(); +?> + +``` + diff --git a/WEB_SERVICE/WEB/_CRITICAL/XML_EXTERNAL_ENTITY_INJECTION/meta.json b/WEB_SERVICE/WEB/_CRITICAL/XML_EXTERNAL_ENTITY_INJECTION/meta.json new file mode 100644 index 00000000..e7e41b95 --- /dev/null +++ b/WEB_SERVICE/WEB/_CRITICAL/XML_EXTERNAL_ENTITY_INJECTION/meta.json @@ -0,0 +1,24 @@ +{ + "risk_rating": "critical", + "short_description": "The web application is susceptible to an XML External Entity (XXE) vulnerability.", + "references": { + "OWASP":"https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)", + "Portswigger": "https://portswigger.net/web-security/xxe#what-is-xml-external-entity-injection" + }, + "title": "XML External Entity (XXE) Injection", + "privacy_issue": false, + "security_issue": true, + "categories": { + "CWE_TOP_25": [ + "CWE_611" + ], + "GDPR": [ + "ART_25", + "ART_32" + ], + "PCI_STANDARDS":[ + "REQ_6_4", + "REQ_6_5" + ] + } +} diff --git a/WEB_SERVICE/WEB/_CRITICAL/XML_EXTERNAL_ENTITY_INJECTION/recommendation.md b/WEB_SERVICE/WEB/_CRITICAL/XML_EXTERNAL_ENTITY_INJECTION/recommendation.md new file mode 100644 index 00000000..6c8aea28 --- /dev/null +++ b/WEB_SERVICE/WEB/_CRITICAL/XML_EXTERNAL_ENTITY_INJECTION/recommendation.md @@ -0,0 +1,55 @@ +Virtually all XXE vulnerabilities arise because the application's XML parsing library supports potentially dangerous XML features that the application does not need or intend to use. The easiest and most effective way to prevent XXE attacks is to disable those features. + +Generally, it is sufficient to disable resolution of external entities and disable support for XInclude. This can usually be done via configuration options or by programmatically overriding default behavior. Consult the documentation for your XML parsing library or API for details about how to disable unnecessary capabilities. + +### Examples + +#### Java + +```java +//Input example : +String xmlInput = "\n" + + "]>\n" + + "&xxe;"; + +DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + +// Enable secure processing mode to mitigate common XML security vulnerabilities +factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); + +// Disable external DTDs and stylesheets to prevent potential XXE attacks +factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); +factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); + +DocumentBuilder builder = factory.newDocumentBuilder(); +Document doc = builder.parse(new ByteArrayInputStream(xmlInput.getBytes())); +``` +#### Javascript + +```javascript +const app = require("express")(); +const libxml = require("libxmljs"); +app.post("/path", (req, res) => { + Element = libxml.parseXml(req.body); + // Processing the XML element +}); +``` + +#### Php + +```php + +]> +&xxe;'; + +$doc = new DOMDocument(); +$doc->loadXML($xmlInput); + +libxml_disable_entity_loader($loadEntities); + +echo $doc->saveXML(); +?> +``` \ No newline at end of file