Page History

...

A user who has the ability to add provide structured XML as input can override the contents of an XML document by injecting XML tags in data fields. These tags are interpreted and classified by an XML parser as executable content and as a result may cause certain data members to be overridden.

...

Code Block

bgColor	#ccccff

class CustomResolver implements EntityResolver {
  public InputSource resolveEntity(String publicId, String systemId)
    throws SAXException, IOException {

    // check for known good entities
    String entityPath = "/home/username/java/xxe/file";
    if (systemId.equals(entityPath)) {
      System.out.println("Resolving entity: " + publicId + " " + systemId);
      return new InputSource(entityPath);
    } else {
      return new InputSource(); // Disallow unknown entities,
                                // by returning a blank path
    }
  }
}

class XXE {
  private static void receiveXMLStream(InputStream inStream,
                                       DefaultHandler defaultHandler)
      throws ParserConfigurationException, SAXException, IOException {
    SAXParserFactory factory = SAXParserFactory.newInstance();
    SAXParser saxParser = factory.newSAXParser();

    // To set the Entity Resolver, an XML reader needs to be created
    XMLReader reader = saxParser.getXMLReader();
    reader.setEntityResolver(new CustomResolver());
    reader.setErrorHandler(defaultHandler);

    InputSource is = new InputSource(inStream);
    reader.parse(is);
  }

  public static void main(String[] args)
      throws ParserConfigurationException, SAXException, IOException {
    receiveXMLStream(new FileInputStream("evil.xml"), new DefaultHandler());
  }
}

...

CERT C Secure Coding Standard	STR02-C. Sanitize data passed to complex subsystems
CERT C++ Secure Coding Standard	STR02-CPP. Sanitize data passed to complex subsystems
CVE-2008-2370	describes a vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16. When a `RequestDispatcher` is used, Tomcat performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="87973560d089486e-9946765f-41ff42a8-abfe963b-7cde3d20376671d1ce2e83d3"><ac:plain-text-body><![CDATA[	[ISO/IEC TR 24772:2010	http://www.aitcnet.org/isai/]	"Injection [RST]"	]]></ac:plain-text-body></ac:structured-macro>
MITRE CWE	CWE-116, "Improper Encoding or Escaping of Output"

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="304ef15ab288ffb0-dd65a1f4-44d540e5-8d6d963e-5a1450b66c2ec6fe2b8e1e8b"><ac:plain-text-body><![CDATA[	[[OWASP 2005	AA. Bibliography#OWASP 05]]		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="3eddfa6f3cff6bf3-986464cb-449041b6-a702806e-1c91e82f58201bd16a222b2c"><ac:plain-text-body><![CDATA[	[[OWASP 2007	AA. Bibliography#OWASP 07]]		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="1cc0f15ad1b91504-d202542c-47b44908-aca5a128-767ac9acab9f546007addff0"><ac:plain-text-body><![CDATA[	[[OWASP 2008	AA. Bibliography#OWASP 08]]	[Testing for XML Injection (OWASP-DV-008)	https://www.owasp.org/index.php/Testing_for_XML_Injection_%28OWASP-DV-008%29]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="77d00fe8194c1257-9ed6c39f-4835407f-96b694a3-55bd3aab728c3caf259ecaa3"><ac:plain-text-body><![CDATA[	[[W3C 2008	AA. Bibliography#W3C 08]]	4.4.3 Included If Validating	]]></ac:plain-text-body></ac:structured-macro>

...

Space shortcuts

Page tree

Versions Compared

Old Version 104

New Version 105

Key