What You Didn't Know About XML External Entities Attacks
summary
A concrete set of XXE exploits appears: parameter entities and DTD bootstrapping let attackers embed file contents or construct URLs, Java jar handler gives directory listings and can spool remote zips to disk (used as an upload primitive), and the gopher protocol can send raw TCP payloads to internal services to trigger Tomcat admin actions. The demo combines these to upload a WAR and achieve RCE on an older Tomcat/Java; limitations include phone‑home ability, XML well‑formedness rules, and quirks per parser. Advice: disable external entities, whitelist URL schemes, and preparse or block dangerous DTD syntax.
AI-written summary · about
chapters (7)
- 0:00Start
- 3:22Point entity to local file or internal HTTP resource - Include entity inline in document - Application exposes the XML contents later
- 16:14Peek inside any ZIP file - Upload files (!)
- 17:11CSRF-like attacks on internal services - Port scanning - Exploiting secondary network vulnerabilities
- 22:36Public web app vulnerable to an XXE flaw
- 31:45Pre-parsing input validation - Block network egress
- 36:36Peek inside any ZIP file - Upload files (1)
related talks
47mHow XML processing leads to security issues: unpacking XXE
26mStranger Danger: Your Attack Surface Just Got Bigger
50mModern WebApp Vulnerabilities
50mStranger Danger: Your Java Attack Surface Just Got Bigger
42mModern web application bugs
56mThe Anatomy of Java Vulnerabilities
40m[In]secure Deserialization, And How [Not] To Do It
58mModern web application bugs