XXE SSRF Attack
Now let’s see how a similar attack can be used to perform server side request forgery (SSRF).
Here the attacker uses XML entities from external sources. When this happens, XXE becomes a server side request forgery (SSRF) attack.
An attacker can run a system command using an XML system identifier. Most XML parsers process external entities by default, and as a result, the server runs the system code in the malicious XML element.
The following code shows how XXE can be used to return the contents of a sensitive file – the etc/hosts file.
| Request | POST http://example.com/xml HTTP/1.1<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE mytype [ <!ELEMENT mytype ANY> <!ENTITY malicious SYSTEM "file:///etc/hosts">]><foo> &xxe;</foo> |
|---|---|
| Response | HTTP/1.0 200 OK IPAddress Hostname Alias127.0.0.1 localhost web.mydomain.com208.164.186.1 web.mydomain.com web 208.164.186.2 mail.openna.com mail(...) |
This attack can be extended to gain access to other files on the server, beyond system files. Some XML parsers make it possible to retrieve directory listings and use them to find other sensitive data on the machine.
Limitations of XXE SSRF attacks
XXE attacks are limited to obtaining files that contain plain text or valid XML. They cannot be used to obtain binary files, or files that contain code that is similar to XML, but in fact is not valid XML. This will return a parser error and the attacker will not be able to view their content.
Related content: Read our guide toServer Side Request Forgery