:PROPERTIES:
:ID:       869e88ed-fe68-47b5-a911-e27cf3927f66
:mtime:    20220307073210
:ctime:    20220306184527
:END:
#+title: XML external entity expension

* Introduction
 * Attaque visant les parseurs XML,
 * Permettant:
   * La divulgation de données, 
   * Le déni de service,
   * /Server-side request forgery (SSRF)/.

* Principe
Le standard XML 1.0, définissant la structure d'un document XML, introduit le concept d'/entity/ qui consiste en une
unité de stockage d'un certain type. Quelques types d'/entity/

There are a few different types of entities, external general/parameter parsed entity often shortened to external entity, that can access local or remote content via a declared system identifier. The system identifier is assumed to be a URI that can be dereferenced (accessed) by the XML processor when processing the entity. The XML processor then replaces occurrences of the named external entity with the contents dereferenced by the system identifier. If the system identifier contains tainted data and the XML processor dereferences this tainted data, the XML processor may disclose confidential information normally not accessible by the application. Similar attack vectors apply the usage of external DTDs, external style sheets, external schemas, etc. which, when included, allow similar external resource inclusion style attacks.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier. Since the attack occurs relative to the application processing the XML document, an attacker may use this trusted application to pivot to other internal systems, possibly disclosing other internal content via http(s) requests or launching a CSRF attack to any unprotected internal services. In some situations, an XML processor library that is vulnerable to client-side memory corruption issues may be exploited by dereferencing a malicious URI, possibly allowing arbitrary code execution under the application account. Other attacks can access local resources that may not stop returning data, possibly impacting application availability if too many threads or processes are not released.

Note that the application does not need to explicitly return the response to the attacker for it to be vulnerable to information disclosures. An attacker can leverage DNS information to exfiltrate data through subdomain names to a DNS server under their control. 



* Références
 * [[https://en.wikipedia.org/wiki/XML_external_entity_attack][Wikipedia]]
