XXE (XML Enternal Entity Injection)
內容
XXE (XML Enternal Entity Injection)
3 Testing
Methods and Procedures
4 Discovered
vulnerabilities and risk assessment
5 Repair
suggestions and strategies
1
Abstract
The target of this
penetration test—" Web Security Academy ," a network security
education platform from PortSwigger —was found to be vulnerable to an XML
vulnerability. This vulnerability allowed the system to successfully display
all accounts on the target Linux platform, including individual user accounts
in addition to the system administrator. However, further attacks, attempting
to obtain user peter 's RSA key, resulted in a "file not found"
error; attempts to obtain the system's password credential file, shodow,
resulted in insufficient permissions.
Conclusion: This
penetration test revealed that the system has risks, but these are considered
low to medium. In the future, data confidentiality can be strengthened by
disabling DTDs or external entity references, preventing XML from becoming an
"insider" that leaks server privacy instead of a simple "data
transmitter."。
2
Purpose and Scope
The purpose of this
penetration test is to highlight our company's penetration testing services and
present them in a complete report format so that our potential clients can
align their needs and use this as a benchmark for commissioning penetration testing
from our company in the future.
After initial contact with
clients, we typically send them a questionnaire, also known as a scope
questionnaire, to better understand their service needs. This scope
questionnaire should clearly explain our services and usually asks them to
select one or more items from a list of options; for example, this report, XXE
, is a type of web application security assessment.。
|
☐Internal vulnerability assessment |
☐External vulnerability assessment |
|
☐Internal penetration testing |
☐External penetration testing |
|
☐ Wireless security assessment |
☐Application security assessment |
|
☐Physical safety assessment |
☐Social engineering assessment |
|
☐Red Team Assessment |
☐Web Application Security Assessment |
The core value of penetration
testing ( PenTest ) for enterprises is not only to "discover
vulnerabilities", but also to conduct a "stress test" on the
overall defense capabilities of the enterprise.
Here are the main benefits that
customers can gain from this:
1. Identify and patch potential
security vulnerabilities.
This is the most direct benefit.
Penetration testers will simulate hacker thinking to find logical
vulnerabilities that automated scanning tools might miss (e.g., improper access
control, flawed business logic).
Specific deliverables: A detailed
list of vulnerabilities, including risk levels (high, medium, and low) and
remediation recommendations.
2. Verify the effectiveness of the
defense mechanism.
Many companies invest heavily in
cybersecurity equipment (such as firewalls, WAFs , IDS/IPS , EDRs ), but are
these devices configured correctly? Can they effectively block attacks in a
timely manner?
Specific outcomes: Testing whether
existing cybersecurity investments can achieve the expected results and
confirming the internal team's detection and response capabilities.
3. Ensure compliance with
regulatory requirements.
Many industry standards (such as
PCI DSS , ISO 27001 , or Taiwan's Cybersecurity Management Act) explicitly
require regular penetration testing.
Specific outcomes: Obtain test
reports that meet audit requirements, reducing the risk of legal penalties or
loss of business contracts due to non-compliance.
4. Reduce the financial risks of
data leakage
A successful hacking attack can
result in hefty compensation payments, system repair costs, and business
interruption losses.
Specific results: By adopting the
"prevention is better than cure" approach, cybersecurity investment
is transformed into an insurance expenditure, avoiding devastating financial
losses in the future.
5. Enhance customer trust and
brand reputation
For companies that provide online
services or process large amounts of sensitive data, conducting regular
cybersecurity tests demonstrates the company's commitment to information
security.
Specific results: When vying for
large corporate clients or supply chain partnerships, a professional
cybersecurity report is often an important endorsement of trust.
6. Provide a communication bridge
between technical and management levels.
Penetration test reports are
typically divided into two parts:
Executive Summary : Explain the
impact of risks on the business to senior management in plain language and
strive for cybersecurity budget.
Technical Findings : Provides
specific attack vectors and code-level patching suggestions for developers and
system administrators to implement.。
3
Testing Methods and Procedures
Test
method:
I. Scanning Tool: Kali Linux * Burp Suite
II. Standard: OWASP WSTG-INPV-07 [1]
The
OWASP Web Security Testing Guide (WSTG) is widely recognized as the most
authoritative blueprint for web security testing in the global cybersecurity
community . It goes beyond theory, providing penetration testers with a set of
standardized procedures that detail the tests to be performed on web
applications, APIs , and services.
OWASP
WSTG-INPV-07
III. Inspection Items:
I. Identify XML injection points.
II.
Assess the types of vulnerabilities that can be exploited and their severity.
Schedule:
I.
Scanning and penetration time: 2026/5/2 17 : 00-19 : 00
II
Report Writing Period: May 9, 2026 - May 23, 2026, 09:00-19 : 00
4
Discovered vulnerabilities and
risk assessment
I. Vulnerability
Name and Description: XML vulnerability, allowing arbitrary program
execution remotely.
II. Types
of Vulnerabilities: XML External Injection Vulnerabilities
III. Severity
score ( CVSS scoring system): 7.2 to 9.8 (out
of 10 )
IV. Affected
Systems or Components:
Affects Linux and Windows cross-platform operating systems.
V. Testing
Process and Screenshots: The target website uses XML to display
product inventory status. After testing, the file content can be read.
Figure 4‑1 Critical Data Leakage and
Remote Execution Program
VI.
Potential Risks and Impacts: Account leakage is considered a medium risk.
Hackers can further use the obtained accounts to perform password spamming
against the system, that is, guessing the password of one account at a time and
then switching to the next account. Because the amount of information sent is
small, it is less likely to be detected and avoids triggering the password
error threshold.
5
Repair suggestions and
strategies
I.
For each discovered vulnerability, provide specific remediation suggestions and
strategies:
II
to enhance the functionality, configure PHP (libxml_disable_entity_loader) to
call libxml_disable_entity_loader(true) before
parsing XML to completely disable the loading of external entities:
1.
libxml_disable_entity_loader(true);
2.
$dom = new DOMDocument();
3.
$dom->loadXML($xml_string,
LIBXML_NOENT);
6
Conclusions
In summary, the most
important finding and recommendation regarding this penetration test is the
severity of misconfiguration . Although the code itself was not problematic in
this test, the penetration test team could still construct a non-existent piece
of code, easily obtaining sensitive information and remotely executing
arbitrary code.
Therefore, when configuring
a website that is publicly accessible, not only should the program content be
repeatedly checked, but the settings (in this example, disabling the loading of
external entities across the entire domain) are also crucial. Preventing
external commands from being executed can more effectively block attackers and
prevent the leakage of sensitive information.
In addition, the
"least privileges" of website users are also very important. After
obtaining the account, the penetration test once went up to obtaining the
password credentials, but stopped due to insufficient permissions. Fortunately,
the account that logged into the website did not have system administrator
privileges, thus avoiding the problem of password credentials being leaked or
further cracked offline.。
7
Attachments and References
XML (Extensible Markup
Language ) is a plain text format used to store, transmit, and structure data.
It uses custom tags (such as `<name> `) to define the data structure and
is characterized by high readability and independence from specific hardware or
software.
Our target machine this
time is a Portswigger machine. Here, we use XML to pass variables instead of
the traditional POST or GET .
URL：https://portswigger.net/web-security/xxe/lab-exploiting-xxe-to-retrieve-files
Figure 7‑1 Target machine , problem
and hints
After looking at the
webpage, I found only one button and one menu. Selecting different
"cities" allows you to view "inventory quantities." I tried
using HackBar but couldn't find a place to inject SQL commands, so I gave up.
However, after some further investigation, it seems I need to "add
something" to Burp Suite .
URL：https://0afe002b03f239bf80e70d21006a0083.web-security-academy.net/product?productId=3
Figure 7‑2 Target Machine Environment
– XML Button
So how did we confirm that
this environment uses XML ? We can start with the source code. Right-click on
the target machine and select "View Source". Notice the line: `
<script src="/resources/js/xmlStockCheckPayload.js"></script>`
. Network attack and defense requires patience and time; it usually requires
finding vulnerabilities in small places. Now that we've confirmed it's XML ,
let's try using Kali 's Burp Suite .。
Figure 7‑3 Target Machine Webpage
Source Code
The
tutorial for installing VMware and Kali Linux is shown in the video at the
following website. After entering Kali Linux , click on Kylin on the left, then
type "Burp" to find Burp Suite Community Edition .
URL：https://youtu.be/7aW8wcTuW2w
Figure 7‑4 BurpSuite
In
the Proxy feature, we select Intercept On (number 1 ). Intercept means that web
pages viewed by the browser will be intercepted first, and will only be sent to
the server after manual permission. Then, we select Open Browser (number 2 ) to
open the Portwigger browser. After opening it, the link is:
URL：https://0a2900820332fadf8038531c00af00fb.web-security-academy.net/product?productId=18
You
will see the XML source code, as shown below, where <product Id> is
currently 3. If we define an xxe and change 3 to xxe here , we may be able to
find sensitive information.
1.
<?xml
version="1.0" encoding="UTF-8"?>
2.
<stockCheck>
3.
<productId>3</productId>
4.
<storeId>2</storeId>
5.
</stockCheck>
Figure 7‑5 Webpage blocking function
and source code
Note:
If we allow access to the webpage, we will see the following screen.
Figure 7‑6 Browsing web pages in the
Portwigger browser
- When a user clicks
" Check stock ," the browser needs to tell the server
"which item I want to check" and "which branch."
- Structured delivery:
Web pages choose to use XML format to encapsulate this information instead
of traditional form format.
- Original request
content:
1.
XML
2.
<stockCheck>
3.
<productId>3</productId>
4.
<storeId>1</storeId>
5.
</stockCheck>
The XML tags here define
the hierarchy of the data, allowing the backend server to easily parse that
productId is 3 .
1.
<?xml
version="1.0" encoding="UTF-8"?>
2.
<!DOCTYPE test [ <!ENTITY
xxe SYSTEM "file:///etc/shadow"> ]>
3.
<stockCheck>
4.
<productId>&xxe;</productId>
5.
<storeId>1</storeId>
6.
</stockCheck>
1.
<?xml
version="1.0" encoding="UTF-8"?>
2.
<!DOCTYPE test [ <!ENTITY
xxe SYSTEM " file:///etc/passwd"> ]>
3.
<stockCheck>
4.
<productId>&xxe;</productId>
5.
<storeId>1</storeId>
6.
</stockCheck>
1.
<?xml
version="1.0" encoding="UTF-8"?>
2.
<!DOCTYPE test [ <!ENTITY
xxe SYSTEM "file:///home/peter/.ssh/id_rsa"> ]>
3.
<stockCheck>
4.
<productId>&xxe;</productId>
5.
<storeId>1</storeId>
6.
</stockCheck>
Figure 7‑7 shows the webpages that
were allowed but blocked
Figure 7‑8 shows the attack was
successful; the target machine displayed a list of system accounts
