I post a question here as a last resort, I have browsed the web and went through many attempts but did not succeed.
Replicating a XXE attack is what I am trying to do, in order to prevent them, but I cannot seem to get my head around the way PHP works with XML entities. For the record I am using PHP 5.5.10 on Ubuntu 12.04, but I have done some tests on 5.4 and 5.3, and libxml2 seem to be of version 2.7.8 (which does not seem to include the default to not resolving entities).
In the following example, calling libxml_disable_entity_loader() with true or false has no effect, or I am doing something wrong.
$xml = <<<XML
<?xml version="1.0"?>
<!DOCTYPE root [
<!ENTITY c PUBLIC "bar" "/etc/passwd">
]>
<root>
<test>Test</test>
<sub>&c;</sub>
</root>
XML;
libxml_disable_entity_loader(true);
$dom = new DOMDocument();
$dom->loadXML($xml);
// Prints Test.
print $dom->textContent;
But, I could specifically pass some arguments to loadXML() to allow some options, and that works when the entity is a local file, not when it is an external URL.
$xml = <<<XML
<?xml version="1.0"?>
<!DOCTYPE root [
<!ENTITY c PUBLIC "bar" "/etc/passwd">
]>
<root>
<test>Test</test>
<sub>&c;</sub>
</root>
XML;
$dom = new DOMDocument();
$dom->loadXML($xml, LIBXML_NOENT | LIBXML_DTDLOAD);
// Prints Test.
print $dom->textContent;
Now if we are changing the entity to something else, as in the following example, the entity is resolved but I could not disable it at all using the parameters or function... What is happening?!
$xml = <<<XML
<?xml version="1.0"?>
<!DOCTYPE root [
<!ENTITY c "Blah blah">
]>
<root>
<test>Test</test>
<sub>&c;</sub>
</root>
XML;
$dom = new DOMDocument();
$dom->loadXML($xml);
// Prints Test.
print $dom->textContent;
The only way that I could find was to overwrite the properties of the DOMDocument object.
- resolveExternals set to 1
- substituteEntities set to 1
Then they are resolved, or not.
So to summarise, I would really like to understand what I am obviously not understanding . Why do those parameters and function seem to have no effect? Is libxml2 taking precedence over PHP?
Many thanks!
References:
- https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing
- https://www.php.net/libxml_disable_entity_loader
- https://www.php.net/manual/en/libxml.constants.php
- http://www.vsecurity.com/download/papers/XMLDTDEntityAttacks.pdf
- http://www.mediawiki.org/wiki/XML_External_Entity_Processing
- How can I use PHP's various XML libraries to get DOM-like functionality and avoid DoS vulnerabilities, like Billion Laughs or Quadratic Blowup?
$dom->loadXML($xml);
is written" - It works with having your ownlibxml_set_external_entity_loader
which blindly takes in. Maybe this has been disabled due to sercurity concerns? maybe the catalog.xml file is missing / used? - Bottom line: check your error messages incl. warnings and notices, you might learn more then in your case.simplexml_load_file()
./etc/passwd
but I know what you're looking for :) )