External Entity Entity Injection [XXE]

• Extensible markup language was designed for for desktop publishing & now it is widely being used for data exchange
• It is a mark up language similar to HTML
• XML is is typically used  instead of HTML when data must be sent from one application to another (Data Interchange) I.e it acts as middleware [JSON,XML are few examples]

Attackers can exploit how an application parses extensible mark up language by taking advantage of an XXE vulnerability. More specifically it involves exploiting how the application processes the inclusion of external entities in it’s input. Attacker can use XXE to extract information from a server or to call on a malicious server.

Attacker can exploit vulnerable XML process if they can upload XML or include hostile content in an XML document, exploiting vulnerable code, dependencies & integrations, these flaws can be used to extract information , execute a remote request to a malicious server , scan internal systems, perform DOS.

Example :

—————

<?xml version=“1.0” encoding”UTF-8:?>

<Jobs>

<Job>

<Title>Test</Title>

</job>

</Jobs>

Document Type Definition

——————————————

 A valid XML document must follow a set of general XML rules and match a document type definition (DTD). An XML DTD is a set of declarations that define which elements exist, what attributes they can have, and which elements can be enclosed within other elements. (An element consists of the opening and closing tags, so an opening <foo> is a tag and a closing </foo> is also a tag, but <foo></foo> is an element.) XML files can either use an external DTD, or they can use an internal DTD that is defined within the XML document.

We updated the XML to define an external entity using XML Data Type Definition

POC Example :

———————

<?xml version=“1.0” encoding”UTF-8:?>

<!DOCTYPE foo [    // Define XML element called foo

<!ELEMENT foo ANY>   // “ ELEMENT Foo allows any type of content”

<!ENTITY XXE “IT WORKS !!” >]>   //  “ Entity XXE will display it works when it is called “

<Jobs>

<Job>

<Title>&XXE;</Title>

</job>

</Jobs>

SPILLING LOCAL FILES VIA XXE WHEN HTTP OOB FAILS

https://www.noob.ninja/2019/12/spilling-local-files-via-xxe-when-http.html

Change content-type in the request to `application/xml` and verify if the application is processing it. If it is processed then you can go on and test for XXE.