A5:2021 | Security Misconfiguration (3) | Cycubix Docs
XXE example
Let’s look at an example of an XXE injection, in the previous section we saw that XML entities can be used as follows:
External DTD declaration
Defining these entities also makes it possible to define another DTD in an external file, for example:
and the email.dtd can be defined as follows:
XXE
If a XML parser is configured to allow external DTD or entities we can change the following XML snippet with the following:
Now what happens? We defined an include from the local filesystem, the XML parser will load the file and will add the contents wherever the entity is referenced. Let’s assume the XML message is returned to the user the message will be:
The extra document type definition(DOCTYPE) is something you can always add to the xml document and if the parser settings are enabled to allow external entities to be processed you are off to a good start for finding a XXE injection.
Last updated
Was this helpful?
