XXE defence(les)s in JDK XML parsers - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2015

XXE defence(les)s in JDK XML parsers

Jonathan Brossard

Résumé

This article will demonstrate that many Oracle JDK XML parsers are vulnerable to Xml eXternal Entity (XXE) attack. We shall also demonstrate that existing Java defenses against XXE attacks fall short and fail to protect against malicious malformed XML, which re- sults in a parsing error with external entities successfully expanded. Our exploit has the capability of exfiltrating files and launching directory traversals. We present a proof of concept dumping filenames under /tmp directory from a remote server running JDK 7 via untrusted XML files. It is our hope to raise awareness of the industry regarding the dangers of XXE-type of attacks. This should also result in upgrading the best practices for disabling external entity resolution for several XML parsers
Fichier principal
Vignette du fichier
Jonathan_Brossard_Blackhat_2015_XXE_Defenseless_JDK_XML_Parsers_JAVA.pdf (86.22 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Licence

Dates et versions

hal-04606163 , version 1 (09-06-2024)

Licence

Identifiants

  • HAL Id : hal-04606163 , version 1

Citer

Jonathan Brossard. XXE defence(les)s in JDK XML parsers. Blackhat USA, Blackhat, Jul 2015, Las Vegas, United States. ⟨hal-04606163⟩
0 Consultations
0 Téléchargements

Partager

Gmail Mastodon Facebook X LinkedIn More