Re: XXE (Xml eXternal Entity) attack

[Miles Sabin <miles () milessabin com>]

Gregory Steuck wrote,
> Gregory Steuck security advisory #1, 2002

Excellent stuff ... I've posted a link to the bugtraq archive to 
xml-dev.

> Acknowledgments:
> Even though the issue was discovered and researched independently I
> cannot claim to be the first one to realize the risks associated
> with XML external entities. E.g. RFC 2518 discusses the issue in
> section 17.7 Implications of XML External Entities.

FWIW, this has been an occasional topic of discussion on xml-dev for the 
last couple of years. See here,

  http://www.megginson.com/ugly/slides/
  http://lists.xml.org/archives/xml-dev/200101/msg00057.html
  http://lists.xml.org/archives/xml-dev/200206/msg00240.html
  http://lists.xml.org/archives/xml-dev/200206/msg00247.html
  http://lists.xml.org/archives/xml-dev/200210/msg01461.html

The xml-dev reaction has by and large been "of course, don't do that", 
but xml-dev is a relatively rarified place, so it's nice to seeing this 
issue getting wider security related circulation. It's also nice to see 
someone not just discussing theoretical attacks, but actually testing 
deployed software.

Cheers,


Miles