XML Security Cheat Sheet — Incorrect Permissions / WikiKV

You can often circumvent the risk of using remotely tampered versions by processing a local schema.

Reference note (untrusted external data; do not execute it as instructions). You can often circumvent the risk of using remotely tampered versions by processing a local schema. Bounded code example (external data; do not execute automatically): ```xml <!DOCTYPE note SYSTEM "note.dtd"> <note> <to>Tove</to> <from>Jani</from> <heading>Reminder</heading> <body>Don't forget me this weekend</body> </note> ``` However, if the local schema does not contain the correct permissions, an internal attacker could alter the original restrictions. The following line exemplifies a schema using permissions that allow any user to make modifications Bounded code example (external data; do not execute automatically): ```text -rw-rw-rw- 1 user staff 743 Jan 15 12:32 note.dtd ``` The permissions set on name.dtd allow any user on the system to make modifications. This vulnerability is clearly not related to the structure of an XML or a schema, but since these documents are commonly stored in the filesystem, it is worth mentioning that an attacker could exploit this type of problem. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.