Java / XML
Explain about XEE/XXE XML security Attacks.
XML Entity Expansion (XEE) also known as XML Expansion/XML Bomb, is an attack that consumes unsuspected vast memory resources. Usually attacker leverages a feature of XML whereby entity references can reference another entity.
In DTD/XML External Entity (XXE) attacks, the victim is made to disclose sensitive/privileged information through weaknesses in the XML parser and the ability of the attacker to modify XML used by the service.
Mitigation strategies:
- Don't use DTDs: Disable DTDS in your parser.
- XML Schema validation: XML comes packed with schemal validation. For easy validation, you can pass the XML data file and the XML schema definition file to the validating XML parser.
- Whitelist definitions: Filter and allow only certain definitions, and block everything that doesn't fit your syntax or regular expression match.
- Blacklist: Block known bad patterns.
More Related questions...
