Welcome to the XML external entity session. In
this first part. We will focus on threat analysis.
We will take our time to dig into XML
format, XML external entities feature and
the xxe processing floors details, then
we will discuss how the system can be harmed. The impact
of successful exploitation and give you some insights to
identify who may want to harm your system. Let's
do this step by step, starting from the beginning, XML,
or extensible, markup language.
Is a markup language that defines the document format. That is both
human and machine readable. How does it look like?
As you surely agree. This is definitely human readable.
We have a books catalog with two entries,
which ideal one the last top, 10 27th, in
addition which several metadata in book ID to
just read information about its author and title. This
format is also machine readable by a
specific type of software processors.
Processors, take XML as input walking through the content
to build a structural representation of the input. This
representation can be manipulated more easily for for
example storing data in a database or
out. Put it in another format such as HTML while.
Doing this processors can also do some additional tasks based
on the input. Directives, the XML standard
defines, the concept called entity, which is
a storage unit of some type external entities,
point to local or remote content. You
A URI, then the processor is
responsible to request such URI and replace all occurrences
of the named external entity in the document, by the retrieved content.
This is how it works. We
declare our external entity desk one whose content should
be loaded from the description dot, txt file, the
processor request, the file content. And then, while
walking through the XML document, whenever this quantity
is found, it gets replaced by the loaded content. You
may already know where this will end up.
Up.
Assuming you are accepting XML file uploads to show their content
in your web application. Then chances are a malicious user
will be able to read arbitrary files from your system. Using
this technique. We will see this in action in the
second part to exploit XML external
entities processing. Attackers should be able to
upload militias XML documents inject hostile data.
In existing XML templates process by the system
or use Integrated Systems and services to retrieve remote
on file data.
Abusing vulnerable XML processors, may allow
attackers together a local data relative to the system where
the processor is running. Since server-side request. Forgery
is also possible. Attackers may be able to
gather internal content via HTTP or https. Xxe,
can also be used to perform Port scanning to
enumerate in fingerprint other internal systems. Such
information may allow the attacker to find other vulnerable systems.
Accessing local resources that did not stop returning data
or creating some sort of XML entity, circular reference
can lead to denial of service. This
attack is commonly referred to as the billion loss of
attack. It also worth mentioning that
under certain circumstances, xxe, may allow
remote code execution in the system where the XML processor
runs.
Based on the impact, your threat agents may get access to
data system information or even control. The system in
case where the remote code execution is possible. Your
data will always be valuable to someone either malicious
actor, looking for ransom nation-state competitors,
or activists, highly motivated to
spy what you're doing.
You'll find this table in the last top 10. Pause the video
and take your time to carefully, read it.
In the next part, we will exploit our Target application to
reach some sensitive data.