Threats from outside – Causes of XXE loophole attacks

Among the OWASP 2017 Top 10 announced at the end of last year, newly added severe risks include: XML external entities, insecure deserialization and insufficient logging and monitoring. In the previous column, insecure deserialization was introduced; this time we will introduce XML external entities. In the following, first a simple introduction of XML is given, then the causes of XXE are explained, and then simple examples are used to show the dangers that it will cause.

What is XML

The full name of XXE Injection is XML External Entity Injection; therefore, before we introduce XXE, let us give a simple introduction on what XML is and its uses.

XML is a pure document type file format; its goal is to save data using simple formats so that the data can be transferred, saved and shared between different platforms.

XML files have two features: DTD and XML Schema. Here we will introduce the so-called DTD, which stands for Document Type Definition. It is used to declare the document type of websites. For example, there are many versions of HTML, including: HTML, HTML2.0, ... , XHTML, and XHTML5 etc. <!DOCTYPE> is used to make browsers display contents accurately, as shown in the figure below:

DTD can also declare the following four types: Elements, Attributes, Entities and Comments. In which Entities is the Entity in XML External Entity Injection. Now let us start introducing XXE Injection.

What is XXE Injection
The full name of XXE Injection is XML eXternal Entity Injection. XXE mainly occurs because the parser did not prohibit the use of external entities. This means that we can define an entity name and define behaviors we want the server to perform in the entity content, therefore the injection point is usually a location where XML can be inputted.
Assume there is a simple webpage that requires entering a nickname, and after it is entered, it was discovered that the data was transmitted using XML format:

Then we may be able to try to make the following changes to the body:

We declared an additional entity xxe with the goal of outputting the password file in this local folder and change the location of the original nickname to the entity name; this is what we will get when parsing of external entities is not prohibited:

The above was a most basic example of XXE injection.
However, one XXE risk does not only cause one danger of local file inclusion; let us modify the payload:

This way we can make the server access the specified external website successfully, which means that it can also cause RCE (Remote Code Execute).
Similarly, we can make the server access internal systems that external networks cannot access, and achieve SSRF (Server-Side Request Forgery).
There is another attack method that is achieved using XXE - Billion Laugh Attack. Its payload is as shown below:

We can see from the CPU of the server that the result it caused is the infamous DoS (Denial-of-service)!

Conclusion
It can be seen from the description above that XXE injection is not a result; we can say that it is a cause because websites that include XXE risks will cause results such as leaking sensitive information, RCE, SSRF and DoS etc.
It is actually not difficult to prevent XXE; simply prohibit the use of external entities completely and the parser will not process the entities declared by attackers, and this can prevent XXE injection from occurring. Take PHP for example, adding libxml_disable_entity_loader(true); in the program code can prevent the parser from processing external entities.