Hi,

This post is regarding XML External Entity Injection.

An XML External Entity attack is a type of attack against an application that parses XML input. Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier. XML External Entity Processing is by no means a complicated bug, but it is difficult to test. This is a relatively esoteric vulnerability compared to other web application attack vectors, like Cross-Site Request Forgery (CSRF).

There are two ways of doing this either through an XML Schema Definition (XSD), or a Data Type Definition (DTD).

Data Type Definitions (DTDs), are what we shall be focusing on since that’s where XML External Entity vulnerabilities occur and Data Type Definition (DTD) called for with an element called bar.

How to defend against an XML external entity injection attack :

• XML external entity injection makes use of the DOCTYPE tag to define the injected entity. It may also be possible to disable the DOCTYPE tag or use input validation to block input containing it.
  

• Need to use input validation to block input containing it, Limit the amount of data that it will retrieve and Set a request timeout to prevent infinite delay attacks
  

• Parsers that are used to process XML from untrusted sources should be configured to disable processing of all external resources.
  

• If the XML is not being built programmatically, you can just scan for any external references and create rules to handle/validate or just deny the file.