Skip to main content

XML injection (XXE)

Need​

Prevention of XML injection attacks

Context​

  • Usage of Python 3 for writing and executing Python code
  • Usage of Django for building web applications
  • Usage of lxml for parsing and manipulating XML data

Description​

Non compliant code​

from django.http import HttpResponse
from lxml import etree

def parse_xml(request):
    xml_data = request.POST['xml_data']
    tree = etree.fromstring(xml_data)
    # process XML data...
    return HttpResponse("XML processed")

The above code is a simple Django view that accepts POST requests containing XML data in the 'xml_data' field. The XML data is parsed using the lxml library's fromstring function.

The vulnerability lies in the fact that the XML data is directly parsed without any validation or sanitization. This means that if an attacker sends a malicious XML payload (for example, an XML External Entity (XXE) injection), the server will process it, potentially leading to data exfiltration, Denial of Service (DoS), or remote code execution.

An XXE attack could look like this:

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [ <!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<foo>&xxe;</foo>

In this case, the attacker is trying to read the contents of the "/etc/passwd" file on the server. If the server processes this XML payload, it could potentially send back the contents of the file to the attacker.

This vulnerability can have serious impacts, as it could allow an attacker to read any file on the system that the server has access to, and even potentially interact with internal systems that the server can communicate with.

Steps​

  • Validate and sanitize user input: Before processing any XML data, validate and sanitize the input to ensure it does not contain any malicious code or unexpected data.
  • Disable external entity resolution: Configure the XML parser to disable external entity resolution. This prevents the parser from accessing external resources or executing remote commands.
  • Use a secure XML parser: Instead of using a general-purpose XML parser like lxml, consider using a specialized XML parser that is designed to handle untrusted input securely.
  • Implement strict input validation: Implement strict input validation to ensure that only valid XML data is accepted by the application.
  • Limit XML processing capabilities: Restrict the XML processing capabilities to only the necessary functionality required by the application. Disable or remove any unnecessary features or options.
  • Implement access controls: Implement access controls to restrict the users or systems that can submit XML data to the application.
  • Regularly update dependencies: Keep all dependencies, including the XML parser library, up to date with the latest security patches and updates.
  • Perform security testing: Regularly perform security testing, including penetration testing and code reviews, to identify and address any potential vulnerabilities in the application's XML processing functionality.

Compliant code​

from django.http import HttpResponse
from lxml import etree
from lxml.etree import XMLSyntaxError

def parse_xml(request):
    xml_data = request.POST['xml_data']
    
    parser = etree.XMLParser(resolve_entities=False)
    
    try:
        tree = etree.fromstring(xml_data, parser)
    except XMLSyntaxError:
        return HttpResponse("Invalid XML data")
    
    # process XML data...
    return HttpResponse("XML processed")

The updated code includes several changes to mitigate the risk of XML External Entity (XXE) injection attacks.

  1. Disable External Entity Resolution: The XMLParser is now configured with resolve_entities=False. This prevents the parser from processing any external entities referenced in the XML data, which is a common vector for XXE attacks.

  2. Input Validation: The etree.fromstring() function is now wrapped in a try/except block that catches XMLSyntaxError exceptions. This exception is raised when the input data is not well-formed XML. By catching this exception, the application can reject invalid XML data before it is processed further.

  3. Secure XML Parser: The code continues to use the lxml library for parsing XML data. While this library is not specifically designed for handling untrusted input, it does provide several features for mitigating common XML-related vulnerabilities, including the ability to disable external entity processing. If the application needs to process untrusted XML data on a regular basis, it may be worth considering a more secure alternative, such as defusedxml.

The other recommendations, such as implementing access controls, regularly updating dependencies, and performing security testing, are not reflected in the code as they pertain to broader application and infrastructure security practices.

References​

Last updated on