WSDL XXE Vulnerability - v0.2

1.1.
1 XXE Vulnerability in WSDL
1.1.1.1 Description
CWE Categories:
 CWE-611: Improper Restriction of XML External Entity Reference ('XXE')
The software processes an XML document that can contain XML entities with
URIs that resolve to documents outside of the intended sphere of control,
causing the product to embed incorrect documents into its output.
An XML External Entity (XXE) attack is a type of attack against an application that
parses XML input. This attack occurs when XML input containing a reference to an
external entity is processed by a weakly configured XML parser. This attack may
lead to the disclosure of confidential data, denial of service, server side request
forgery, port scanning from the perspective of the machine where the parser is
located, and other system impacts.
Pen-tester found XXE vulnerability during external black-box penetration test of

Application_Name web service WSDL in the UAT environment. Affected URL is as
follow:
o https://www.client-name.com/folder1/servicename
The following screenshot was taken from UAT environment where a POST SOAP
request was sent to the server. The request contains an XXE script requesting a
DNS request to 3459i47ja3fz2li6pfp6mablcci46w3m8a6yxpkf84.burpcollaborator.net:
c c
c c
The application performed a DNS lookup of the specified domain, indicating that the
XML parser processed the injected doctype definition:
1.1.1.2 Threats and risks
Risk: EXTREME (Impact: Major, Likelihood: Likely)
XXE attacks can include disclosing local files, which may contain sensitive data such
as passwords or private user data, using file: schemes or relative paths in the
system identifier. Since the attack occurs relative to the application processing the
XML document, an attacker may use this trusted application to pivot to other internal
systems, possibly disclosing other internal content via http(s) requests or launching
a CSRF attack to any unprotected internal services. In some situations, an XML
processor library that is vulnerable to client-side memory corruption issues may be
exploited by dereferencing a malicious URI, possibly allowing arbitrary code
execution under the application account. Other attacks can access local resources
that may not stop returning data, possibly impacting application availability if too
many threads or processes are not released.
Next example shows pen-tester send a SOAP request to perform an HTTP request.
This PoC shows it is possible to induce the application to perform server-side HTTP
requests to arbitrary domains. The tag <!DOCTYPE soapenv:envelope PUBLIC
"-//B/A/EN"
"http://8foet9iol8q4dqtb0k0bxfmqnht9h1erjfh38uvkj9.burpcollaborator.net"> was
injected into the XML sent to the server. This payload defines an XML doctype that
references a URL on an external domain. Below screenshot shows the HTTP
request:
The application performed an HTTP request to the specified domain, indicating that
the XML parser processed the injected doctype definition:
1.1.1.3 Recommendations
1.1.1.3.1 CORRECTIVE ACTION (QUICK FIX)
The following corrective action is recommended:
a) Disable DOCTYPE
It is recommended to disable DOCTYPE resolution in the XML library; an

upgrade of XML library component usually is needed to fix this vulnerability.
It is also recommended to disable IS_SUPPORTING_EXTERNAL_ENTITIES

and XMLInputFactory.SUPPORT_DTD properties.
1.1.1.3.2 PREVENTIVE ACTION (FUNDAMENTAL FIX)
The following preventive action is recommended:
a) Conduct comprehensive application security testing before going live
Before launching of any web-application based product, comprehensive security

assessment shall be performed as part of application testing to ensure
conformance to control specified in Client_Name's security
standards/requirements. Basic testing can be performed using automated tools.
However, automated vulnerability detection technique e.g. using application
security scanners is not fully accurate. Final web-application security testing
shall also be performed by an independent 3rd party security specialist.
1.1.1.4 Effort to remediate
Corrective action effort rating: MEDIUM
Medium effort is required to change the configuration on the production server.
Preventive action effort rating: MEDIUM
Development of security standards and policies will not require significant efforts.
1.1.1.5 Target group
The following teams/personnel will likely be involved in remediation efforts and

should be informed of this finding:
 Application owners,
 Information security team.
1.1.1.6 Reference to standards
Standard and policies related to this finding:
 ISO/IEC 27001:2013:
o A.12.6 Technical vulnerability management: To prevent exploitation of

technical vulnerabilities.
1.1.1.7 References
For more information, refer to the following web pages:
http://cwe.mitre.org/data/definitions/548.html
1.1.1.8 Current status
This finding was reported on 07.09.2016 and is yet to be re-tested.

WSDL XXE Vulnerability - v0.2

Uploaded by

Copyright:

Available Formats

WSDL XXE Vulnerability - v0.2

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

WSDL XXE Vulnerability - v0.2

Uploaded by

Copyright:

Available Formats

1.1.

1 XXE Vulnerability in WSDL

 CWE-611: Improper Restriction of XML External Entity Reference ('XXE')

Pen-tester found XXE vulnerability during external black-box penetration test of

1.1.1.2 Threats and risks

Risk: EXTREME (Impact: Major, Likelihood: Likely)

1.1.1.3.1 CORRECTIVE ACTION (QUICK FIX)

The following corrective action is recommended:

It is recommended to disable DOCTYPE resolution in the XML library; an

It is also recommended to disable IS_SUPPORTING_EXTERNAL_ENTITIES

1.1.1.3.2 PREVENTIVE ACTION (FUNDAMENTAL FIX)

The following preventive action is recommended:

a) Conduct comprehensive application security testing before going live

Before launching of any web-application based product, comprehensive security

1.1.1.4 Effort to remediate

Corrective action effort rating: MEDIUM

Medium effort is required to change the configuration on the production server.

Preventive action effort rating: MEDIUM

1.1.1.5 Target group

The following teams/personnel will likely be involved in remediation efforts and

 Information security team.

1.1.1.6 Reference to standards

Standard and policies related to this finding:

o A.12.6 Technical vulnerability management: To prevent exploitation of

For more information, refer to the following web pages:

1.1.1.8 Current status

This finding was reported on 07.09.2016 and is yet to be re-tested.

You might also like