Definition
An XML External Entity (XXE) attack exploits vulnerabilities in XML parsers that process external entities. Attackers leverage this flaw to access files or services on the victim's machine.How It Works
- 1An attacker creates a malicious XML file with a reference to an external entity.
- 2The XML parser processes this file and resolves the external entity.
- 3This can result in reading local files, executing server-side requests (SSRF), or causing denial-of-service attacks such as the 'Billion Laughs'.
Key Characteristics
- Targets XML parsers supporting external entities.
- Can result in data exfiltration, SSRF, or denial of service.
- Often exploited through improper input validation.
Comparison
| Concept | Attack Methodology |
|---|---|
| XXE | Exploits XML parsers with external entities. |
| SQL Injection | Alters SQL queries to access unauthorized data. |
| SSRF | Tricks a server into making unintended requests. |
Real-World Example
CVE-2014-3660 is a significant XXE vulnerability in the libxml2 library. This flaw enabled attackers to read arbitrary files on the host system.Detection & Prevention
- Disable DTD processing in XML parsers.
- Prefer JSON over XML when feasible.
- Use security tools like Burp Suite and OWASP ZAP for testing.
Common Misconceptions
- Only impacts XML applications: XXE can affect any system processing XML data.
- Just a file read issue: XXE can cause various attacks like SSRF and DoS, not just file reading.