XML Injection Attack review

In this post, I would like to share about XML Injection Attack that might be useful for some scenarios. For those who are not familiar with XML Injection attack, XML Injection is an method that been used by the attacker to manipulate or exploit the logic of any XML Application or Service that resides in.

By doing an XML Injection, the attacker can usually cause the application or message to compromise with any insertion of malicious content. This will be compromised by dereferenced from the XML processor (can read my previous post about this here).

Below are the example of XML Injection Code that can be found resides within a vulnerable website:

Besides an example above, there can also be code such as <!ELEMENT> and <!ENTITY> where it’s a common structure of XML formating.

For the attack, we can use the CDATA as our payload which will inject an illegal character that normally been ignored by XML parsers. It also can expose the website to other type of attack such as Cross-Site-Scripting(XSS)

An example of the Payload for the XSS attack would look something like follows:

<HTML> <![CDATA[<IMG SRC=http://www.demo.com/demo.gif onmouseover=javascript:alert(‘XSS attack’);>]]> </HTML>

Other than XSS, this vulnerable

Read More: https://threatninja.net/xml-injection-attack-review/