XXE vulnerability in SimpleXML #18
Description
Hi, there.
Recently, I learned about SimpleXML and tried my luck to find some bugs. Here is what I found.
As you know, SimpleXML can serialize and deserialize XML document. So I tested for these functions and finally I found these can lead to an XXE vulnerability.
First, I tried to inject payloads into the attributes. However, SimpleXML cannot resolve external entity in attribute of the element.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE user [<!ENTITY internal SYSTEM 'file:///c:/windows/win.ini'>]>
<example index="&internal;">
<text>Example message</text>
</example>
It will raise an exception when resolve the XML document above because SimpleXML cannot resolve external entity in attributes.
However, external entity can be used at elements' text nodes:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE user [<!ENTITY internal SYSTEM 'file:///c:/windows/win.ini'>]>
<example index="123">
<!-- SimpleXML didn't forbid external entity in xml elements-->
<text>Example message:&internal;</text>
</example>
When deserialize this document above, we can retrieve the content of win.ini in C disk. Also, we can use http, gopher, dict protocol in XXE attack.
More details in PoC.java(test version is 2.7.1).
Besides, Retrofit is also affected by this vulnerability because of the usage of SimpleXML inside.
To fix it, you can limit the resolving of external entities in XML document.
Let me know if you have problem to reproduce this issue.
Thanks!