XML Schema, DTD, and Entity Attacks

[Nytro]

XML Schema, DTD, and Entity Attacks

May 19, 2014

Version 1.0

Timothy D. Morgan (@ecbftw)

Omar Al Ibrahim (oalibrahim@vsecurity.com)

Contents
Abstract...............................................................................................................................................................................3
Introduction........................................................................................................................................................................4
Motivation............................................................................................................................................................................................................. 4
Background........................................................................................................................................................................................................... 4
Prior Art................................................................................................................................................................................................................ 5
General Techniques...........................................................................................................................................................6
Resource Inclusion via External Entities........................................................................................................................................................ 6
URL Invocation.................................................................................................................................................................................................... 7
Parameter Entities.............................................................................................................................................................................................. 9
External Resource Inclusion via XInclude Support................................................................................................................................... 12
Denial of Service Attacks................................................................................................................................................................................ 13
Implementation-Specific Techniques and Limitations.............................................................................................15
Java / Xerces...................................................................................................................................................................................................... 15
C# / .NET........................................................................................................................................................................................................... 19
Expat.................................................................................................................................................................................................................... 24
Libxml2................................................................................................................................................................................................................ 25
PHP...................................................................................................................................................................................................................... 26
Python................................................................................................................................................................................................................. 28
Ruby..................................................................................................................................................................................................................... 28
Recommendations For Developers............................................................................................................................29
Java / Xerces...................................................................................................................................................................................................... 29
C# / .NET........................................................................................................................................................................................................... 30
Expat.................................................................................................................................................................................................................... 32
Libxml2................................................................................................................................................................................................................ 32
PHP...................................................................................................................................................................................................................... 32
Python................................................................................................................................................................................................................. 32
Ruby..................................................................................................................................................................................................................... 33
Recommendations For XML Library Implementors..............................................................................................33
Future Work.....................................................................................................................................................................34
Acknowledgements........................................................................................................................................................34
References........................................................................................................................................................................35

Download:http://vsecurity.com/download/papers/XMLDTDEntityAttacks.pdf