Member-only story
3 Steps Discovered XXE You Should Know
1. XXE
First off, What is an “XXE”?
XXE (XML External Entity Injection) stands for XML External Entity Injection. As the name suggests, it is an injection vulnerability that injects what? XML external entities.
2. Intro XML
XML is a widely used markup language that was first standardized in the late 1990s and has been adopted by countless software projects. It is used for configuration files, document formats (such as OOXML, ODF, PDF, RSS, etc.), image formats (SVG, EXIF headers), and network protocols (WebDAV, CalDAV, XMLRPC, SOAP, XMPP, SAML, XACML, etc.). Its applications are so widespread that any issues with it can have catastrophic consequences.
During the process of parsing external entities, XML parsers can query various network protocols and services (such as DNS, FTP, HTTP, SMB) based on the scheme (protocol) specified in the URL. External entities are useful for creating dynamic references within a document, so any changes made to the referenced resource will automatically update in the document. However, handling external entities can lead to numerous attacks against an application. These attacks include leaking sensitive data, such as passwords and private user data, by accessing local system files or manipulating internal applications through the…
