the-web-application-hackers-handbook

384 Chapter 10 n Attacking Back-End Components
Injecting XML External Entities
In today’s web applications, XML is often used to submit data from the client
to the server. The server-side application then acts on this data and may return
a response containing XML or data in any other format. This behavior is most
commonly found in Ajax-based applications where asynchronous requests are
used to communicate in the background. It can also appear in the context of
browser extension components and other client-side technologies.
For example, consider a search function that, to provide a seamless user
experience, is implemented using Ajax. When a user enters a search term, a
client-side script issues the following request to the server:
POST /search/128/AjaxSearch.ashx HTTP/1.1
Host: mdsec.net
Content-Type: text/xml; charset=UTF-8
Content-Length: 44
nothing will change
The server’s response is as follows (although vulnerabilities may exist regardless
of the format used in responses):
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 81
No results found for expression: nothing will
change
The client-side script processes this response and updates part of the user
interface with the results of the search.
When you encounter this type of functionality, you should always check for
XML external entity (XXE) injection. This vulnerability arises because standard
XML parsing libraries support the use of entity references. These are simply a
method of referencing data either inside or outside the XML document. Entity
references should be familiar from other contexts. For example, the entities
corresponding to the < and > characters are as follows:
&lt;
&gt;
The XML format allows custom entities to be defined within the XML document
itself. This is done within the optional DOCTYPE element at the start of the
document. For example: