Exploiting XXE Using External Entities Files - A Walkthrough

Introduction

XXE (XML External Entity Injection) is an attack that exploits the way applications parse XML input. By injecting malicious XML entities, an attacker can read sensitive files, conduct SSRF attacks, or even achieve remote code execution in some cases.

This la has a “Check stock” feature that accepts XML input. Our goal is to exploit this feature by injecting an external entity to read the contents of the /etc/passwd file.

Identifying the Vulnerability

1. The “Check stock” feature likely accepts XML input.

2. If the XML parser is not properly configured, it might process external entities, leading to XXE.

Crafting the Payload

To exploit the vulnerability, we use the following XML payload:

Explanation:

1. <!DOCTYPE foo> : Defines a new document type.

2. <!ENTITY xxe SYSTEM “file: ///etc/passwd”> : Creates an external entity that reads the /etc/passwd file.

3. &xxe; : Injects the entity into the productId field.

Exploiting the lab

1. Navigate to the “Check stock” feature.

2. Intercept the request using Burp Suite.

3. Modify the XML body with our XXE payload.

   

4. Forward the request and check the response.

5. If successful, we will see the contents of /etc/passwd.

Mitigation

To prevent XXE attacks, developers should:

1. Disable external entity parsing in XML parsers.

2. Use whitelisted input validation.

3. Implement Web Application Firewalls(WAFs).

4. Switch to JSON-based input where possible.

Conclusion

This lab demonstrates the risks associated with poorly configured XML parsers. XXE is a severe vulnerability that can lead to data exfiltration, SSRF, or RCE. Always ensure XML parsers are securely configured to prevent such attacks.