Contents
V5335. OWASP. Potential XXE vulnerability. Insecure XML parser is used to process potentially tainted data.
The analyzer has detected the use of an insecure XML parser that processes external data. This could make the application vulnerable to an XXE attack. More details about the attack are described here.
This vulnerability can be categorized under the OWASP Top 10 classification as follows:
Consider the example: an application accepts requests in the form of XML files and processes goods with the corresponding identifier. If the identifier is invalid, the application notifies users.
The XML file format used by the application:
<?xml version="1.0" encoding="utf-8" ?>
<shop>
<itemID>62</itemID>
</shop>The following code performs the processing:
public static void processItemWithID(String pathToXmlFile) {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
var document = builder.parse(pathToXmlFile); // <=
var nodeList = document.getElementsByTagName("itemID");
String itemiD = nodeList.item(0).getTextContent();
try {
long itemIDvalue = Long.parseLong(itemiD);
// process the item with 'itemIDvalue' value
System.out.printf("An item with the %d ID was processed.%n", itemIDvalue);
} catch (NumberFormatException e) {
System.out.printf("%s is not valid 'itemID' value.%n", itemiD);
}
}For the XML file above, the application outputs the following line:
An item with the '62' ID was processed.If something else is written in the ID instead of a number (for example, "Hello world"), the application reports an error:
"Hello world" is not valid 'itemID' value.Although the code performs its task, it is vulnerable to XXE attacks because:
- the XML content comes from the user;
- the XML parser is configured to process external entities;
- the output can be sent back to the user.
The example of malicious XML that can be used to compromise the code:
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file://D:/MySecrets.txt">
]>
<shop>
<itemID>&xxe;</itemID>
</shop>The file declares the external xxe entity, which the parser processes. As a result, the contents of the D:/MySecrets.txt file (e.g., This is an XXE attack target.) on the machine where the application is running can be displayed to the user:
This is an XXE attack target. is not valid 'itemID' value.To protect against such an attack, disable the processing of external entities and DTD. In the example described above, the processing of external entities is disabled by specifying the following lines before creating a DocumentBuilder instance:
String feature = "http://xml.org/sax/features/external-general-entities";
factory.setFeature(feature, false);To completely disable DTD processing, do as follows:
String feature = "http://apache.org/xml/features/disallow-doctype-decl";
factory.setFeature(feature, true);Note. There are many parsers designed to process XML documents. Their vulnerability to XXE depends on configuration and version. For some common parsers, protection approaches against XXE are described here.
This diagnostic is classified as:
|
Was this page helpful?
