XXE attack in Node.js? How to prevent XXE attack in Node.js?

Node.js / June 22, 2022 / TopCode / 8

Introduction

In this blog post, You will learn what are XML External Entities, How does it impact on user’s application, and how to prevent it.

What are XML External Entities (XXE)?

According to OWASP, “An XML External Entity attack is a type of attack against an application that parses XML input.” This attack happens when a weakly configured XML parser processes untrusted XML data. This untrusted XML data could be an external XML entity. This type of attack uses external entity references to access arbitrary files on a system, remote code execution(RCE), carry out denial-of-service (DoS) attacks, or server-side request forgery(SSRF) attacks.

Impact of XXE attack

If your web application does XML parsing and the XML parser is weakly configured then the web application can be vulnerable to XXE attacks.

Case #1: The attacker attempts to extract data from the server:

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE bar [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<bar>&xxe;</bar>

Case #2: An attacker probes the server’s private network by changing the above ENTITY line to:

<!ENTITY xxe SYSTEM "https://192.168.1.2/private" >]>

Case #3: An attacker attempts a denial-of-service attack by including a potentially endless file:

<!ENTITY xxe SYSTEM "file:///dev/random" >]>

Check for XXE vulnerability

The XML-based web application or underline integrations might be vulnerable to XXE attack if:

• The application accepts XML data directly from untrusted sources, or inserts untrusted data into XML documents, which is then parsed by an XML processor.
• Any of the XML processors in the application or SOAP-based web services has document type definitions (DTDs) enabled.
• If the application uses SOAP prior to version 1.2, it is likely vulnerable to XXE attacks if XML entities are being passed to the SOAP framework.
• If an application is vulnerable to XXE attacks means that the application is vulnerable to denial of service attacks. The Billion Laughs attack is also a DOS attack.
• If the application uses SAML for identity processing within federated security or single sign on (SSO) purposes as SAML uses XML for identity assertions, and may be vulnerable to XXE attack.

XXE attack example in Node.js

The following code snippet is vulnerable to XXE attack. The code uses the libxml which is XML parser library to parse a string xmlPayload. If that string is from an untrusted source, this code may be vulnerable to an XML External Entity attack, since the parser is called with the noent option set to true:

const app = require("express")(),
const libxml = require("libxmljs");

app.post("/parser", (req, res) => {
  let xmlPayload = req.body,
  doc = libxml.parseXml(xmlPayload, { noent: true });
});

The exploit will instruct the parser to read the /etc/passwd file from the server’s file system. Following is the vulnerable Payload:

<!DOCTYPE read-fs [<!ELEMENT read-fs ANY ><!ENTITY passwd SYSTEM "file:///etc/passwd" >]><users><user><read-fs>&passwd;</read-fs><name>C.K Frode</name></user></users>

Prevent XXE attack in Node.js Example

To guard against XML External Entity attacks, the noent option should be omitted or set to false. This means that no entity expansion is undertaken at all, not even for standard internal entities such as & or >

Following is the safer implementation against XXE attack in Node.js:

const app = require("express")(),
const libxml = require("libxmljs");

app.post("/parser", (req, res) => {
  let xmlPayload = req.body,
  doc = libxml.parseXml(xmlPayload);
});

References:

• OWASP: XML External Entity (XXE) Processing.
• Timothy Morgen: XML Schema, DTD, and Entity Attacks.
• Timur Yunusov, Alexey Osipov: XML Out-Of-Band Data Retrieval.
• Common Weakness Enumeration: CWE-611.
• Common Weakness Enumeration: CWE-827.

#xxe attack in nodejs xxe attack #xxe attack node.js #xxe attackn in node.js #xxe attack owasp #xxe attack tutorial #xml xxe attack #xxe attack prevention java #xxe attack example #xxe attack soap #xxe attack prevention #xxe attack prevention node.js #xxe attack mitigation in node.js #xxe attack mitigation node.js #xxe attack is a type of attack against an application that parses xml input #findbug xxe attack #node.js xxe attack #best way to prevent xxe attack #how to do xxe attack #out-of-band xxe attack #how to do an xxe attack #in-band xxe attack #xxe attack tools #how to test xxe attack #ddos via xxe attack #xxe attack code #xxe attack how #what is xxe attack #java prevent xxe attack #blogengine xxe attack #xxe attack firestick #xxe attack explained #xxe attack with filter #httparty xxe attack #block xxe attack #block xxe attack node.js #how to generate xxe attack in node.js XML External Entities attack #XML External Entities attack node.js #XML External Entities attackn in node.js #XML External Entities attack owasp #XML External Entities attack tutorial #xml XML External Entities attack #XML External Entities attack prevention java #XML External Entities attack example #XML External Entities attack soap #XML External Entities attack prevention #XML External Entities attack prevention node.js #XML External Entities attack mitigation in node.js #XML External Entities attack mitigation node.js #XML External Entities attack is a type of attack against an application that parses xml input #findbug XML External Entities attack #node.js XML External Entities attack #best way to prevent XML External Entities attack #how to do XML External Entities attack #out-of-band XML External Entities attack #how to do an XML External Entities attack #in-band XML External Entities attack #XML External Entities attack tools #how to test XML External Entities attack #ddos via XML External Entities attack #XML External Entities attack code #XML External Entities attack how #what is XML External Entities attack #java prevent XML External Entities attack #blogengine XML External Entities attack #XML External Entities attack firestick #XML External Entities attack explained #XML External Entities attack with filter #httparty XML External Entities attack #block XML External Entities attack #block XML External Entities attack node.js #how to generate XML External Entities attack in node.js

cyber-security, node, node.js, nodejs, xxe