Welcome to the third and last part of XML external entity
session. In this part. We will discuss
XML external, entities, flood mitigation. We
will start discussing what makes an application vulnerable. And
then, we will hunt a wasp Juice Shop, vulnerable source code.
Before closing the session, we will discuss how to
avoid such vulnerabilities. If an application accepts,
XML directly allows XML file uploads or
arbitrary input data to be inserted into XML templates.
Later.
Parsed by an XML processor, then it made me vulnerable.
If any of the XML processors in the application or other
integrated Services outdated or has DTD document
type definition enabled. Then
the application may be vulnerable or at risk security assertion
markup language uses XML. If
you're using it for single sign-on, then your application might be
vulnerable. So prior to version 1.2 when
XML entities, are passed to the soap, framework are
likely vulnerable to xxe.
Let's have a look at the source code.
From Project page, we can jump directly to the GitHub repo and
find the file upload route.
This is the function that handles the XML upload.
XML Doc is the result of calling parse XML function
passing in the upload file content.
Several options are passed to the function. No end is the
most suggestive, one.
Let's find package documentation and see what this option does.
The XML processor is part of the live XML J
S2 package.
Parse XML string function. Sounds like what we are looking for. Let's
see. What options does it except.
The no end option.
When set to True entities occurrences will
be replaced by the content. They hold previously retrieved by
the processor from the resource. They point to this
is what makes Juice Shop vulnerable. It
should be set to false to prevent xxe attacks.
Make sure that all XML processors and
libraries in use by the application or on the underlying operating
system are up to date and latest security. Patches
were applied upgrade soap to soap, 1.2 or
hire, disabled XML, external entities, and
document type definition features in all XML processors.
Check the last cheat sheet. X60 prevention
to get more details on how to do it for several programming
languages and Frameworks. Proper server-side input,
validation filtering, and sanitization arm.
And
Authority to prevent hostile data to be included in
XML documents Heather's or other Integrated Systems.
In our next session, we will discuss broken Access Control flaws
until then. Take your time to carefully, read
the XML external entity section of a wasp top
10.