CodePark/ questions / Deserialization, XML, archives & paths
START PRACTICINGPRACTICE
Backend question · Auth & security › Deserialization, XML, archives & paths

Your API imports invoices as XML. A user uploads this file, and the response shows the note field. What is the attack, and what is the main fix?

<?xml version="1.0"?>
<!DOCTYPE invoice [
  <!ENTITY x SYSTEM "file:///etc/passwd">
]>
<invoice><note>&x;</note></invoice>
XXE (XML External Entity): turn off DTDs and external entity resolution in the XML parser

The DTD defines an external entity x that points at a local file. A parser that resolves entities puts the file's content into note. The same trick with an http:// URL becomes SSRF. Nested entities can also blow up memory, which is the billion laughs attack. Fix it in the parser: turn off DTDs and external entities. Many JavaScript XML parsers don't resolve them by default, but libxml2 bindings can when you turn on options like noent.

"SSRF: block outgoing requests" is the tempting wrong answer. SSRF is one effect of XXE, but blocking egress doesn't stop local file reads. SVG, DOCX, XLSX and SAML are all XML, so they need the same care.