Contents
V5336. OWASP. Potential XEE vulnerability. Insecure XML parser is used to process potentially tainted data.
The analyzer has detected the use of an insecurely configured XML parser, which processes data without limiting XML entity usage. This can expose an application to an XEE attack (also known as a billion laughs attack or XML bomb attack). You can find more details about the attack here.
This vulnerability can be categorized under the OWASP Top 10 classification as follows:
A lack of control over the number of recursive entity definitions can sometimes lead to the possibility of an XEE attack. If an attacker gets the chance to send an XML file to the application, complex processing that can overwhelm the parser will begin. This complex processing is disabled by default in modern parsers, but to ensure security, it is recommended to explicitly disable nested and external entities.
Let's look at a simple example involving an insecure setting in DocumentBuilderFactory:
Document readXML(String xml) throws .... {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, false);
return factory.newDocumentBuilder().parse(xml);
}In this example, developers disabled the secure XML processing mode by explicitly setting it to false. As a result, the following limitations are disabled:
- the recursion depth limit when processing DTDs;
- the limit for the number of entities.
To protect the application from XEE attacks, you can disable external entity processing and explicitly enable secure XML parsing mode:
Document readXML(String xml) throws .... {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
String feature = "http://xml.org/sax/features/external-general-entities";
factory.setFeature(feature, false);
return factory.newDocumentBuilder().parse(xml);
}There are many parsers designed to process XML documents. These parsers may be vulnerable to XEE depending on their configuration and version. For some common parsers, protection approaches against XXE are described here.
Was this page helpful?
