2

If you Google for an example of XXE injection you get something like this:

<?xml version="1.0" encoding="ISO-8859-1"?>
  <!DOCTYPE foo [  
   <!ELEMENT foo ANY >
   <!ENTITY xxe SYSTEM "file:///dev/random" >]><foo>&xxe;</foo>

where the attack is carried out from within the DTD - so at the very top of a document.

Is it instead possible to inject XML External Entities from within the body of an XML document rather than its DTD and, if so, how?

EDIT: As an example, we have a system that generates XML documents with some user-provided data from a database. The system does escape those values using CDATA but doesn't do anything else to it, so you (as a - malicious - user) could easily store some data to close the CDATA section and write XML. So long as the XML is correct and passes some XSD validation, the system is a happy system.

EDIT: Could xs:import (or similar) be used?

XCore
  • 244
  • 1
  • 8

1 Answers1

2

You should be OK, if the XML parser is compliant. Per the XML 1.1 spec,

The document type declaration MUST appear before the first element in the document.

However, it wouldn't be unheard of for an XML parser to fail to enforce this restriction. An XML doc with a <!DOCTYPE tag following the first element would not be well-formed, but might still be treated as though it were by some parsers, in the same way that malformed HTML is often tolerated by browsers.

Additionally, an attacker could close the entire XML document, and start a new one. The new one would not have any elements in it yet, so the doctype could be put in its correct location. The question then would be, what does your parser do with two (well-formed) documents when it only expected one?

CBHacking
  • 40,303
  • 3
  • 74
  • 98
  • As far as I can see, it's not doing some magic stuff behind the scenes (i.e. no auto-close + new doc, nor silently accepting the not well-formed doc) and it's just throwing an exception saying the doc is not well-formed. But I'll try and actually close the document and start a new one and see what happens. (Will edit this when done - in 3hrs top) – XCore Sep 25 '19 at 08:40
  • Can't manually close the doc and open a new one as there's a char limit. – XCore Sep 25 '19 at 08:55
  • Would xs:import or similar help? – XCore Sep 25 '19 at 08:56