CS.XXE.TEXT

Possible XML External Entity (XXE) attack

The CS.XXE.TEXT_READER checker flags instances of XML input that are processed by a weakly configured XmlTextReader parser.

Vulnerability and risk

An XML External Entity attack is a type of attack against an application that parses XML input. This attack occurs when XML input that contains a reference to an external entity is processed by a weakly configured XML parser. This attack can lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.

Mitigation and prevention

The safest way to prevent an XXE attack is to completely disable DTDs (External Entities). Depending on the parser, the method can be different. For example, in .NET 4.5.2+, XmlTextReader has DTDs disabled by default, and can only become unsafe if you use a nonnull XmlResolver with default or unsafe settings.

Vulnerable code example

Copy

1
2
3
4
5
6
7
8
9
10
11
12
  static void LoadXML()
   {
     string xxePayload = "<!DOCTYPE doc [<!ENTITY win SYSTEM 'file:///C:/Users/SecretData.txt'>]>"
                       + "<doc>&win;</doc>";
     string xml = "<?xml version='1.0' ?>" + xxePayload; 
   
      XmlTextReader reader = new XmlTextReader(xml);
      reader.XmlResolver = new XmlUrlResolver(); // Defect: XmlTextReader.XmlResolver configured 
                                                 // with XmlUrlResolver makes it unsafe
     while (reader.Read())
     { ... }
  }

Fixed code example

Copy

1
2
3
4
5
6
7
8
9
10
  static void LoadXML()
  {
      string xxePayload = "<!DOCTYPE doc [<!ENTITY win SYSTEM 'file:///C:/Users/SecretData.txt'>]>" + "<doc>&win;</doc>";
      string xml = "<?xml version='1.0' ?>" + xxePayload; 
   
      XmlTextReader reader = new XmlTextReader(xml);
      reader.XmlResolver = null;
      while (reader.Read())
      { ... }
 }

Related checkers

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Xml External Entity Injection Training Video - Test your skills with a training example