XML Parser Evaluation

For some time now, we've been researching in excruciating detail the prevalence of DTD attacks on different XML parsers.

For a quick recap which attacks are possible, see our DTD Cheat Sheet post.

In this post, we present you the results in a nutshell.
The information presented here is based on this masterthesis which covers the respective results in greater detail.

Test Methodology

We identified 16 test vectors, each testing a specific attack vector (e.g. XXE, various kinds of DoS, XXE parameter entity,...). We ran these tests against the default parser configuration and call these therefore core tests.

Additional tests are based on the same test vectors, however, we executed them against custom (modified) parser configurations, indicating the effect of specific features of a parser.

The complete test set is available on github.

Results

We analyzed the following parsers and summarized the test results in Table 1. In addition, we show which attacks cannot be mitigated indicated by an asterisk.

Countermeasures

To keep this post short we only provide keywords for available countermeasures.
More information on how to apply a specific countermeasure is available in the corresponding test files available on github.
A description of a specific countermeasure is available in the masterthesis.
Just navigate to the corresponding section (e.g. Ruby -> REXML) and follow the instructions from there on to get the information you are interested in.

Ruby

REXML

DoS attacks (A built-in threshold limits the size to 100 MB) - Set the features entity_expansion_limit or entity_expansion_text_limit

Nokogiri

DoS attacks - No Countermeasures

Python

minidom

DoS attacks - No Countermeasures

etree

DoS attacks - No Countermeasures

lxml

DoS attacks - Set the feature resolve_entities = false
XXE attacks - Set the feature resolve_entities = false

xml.sax/pulldom

DoS/XXE/URL Invocation - No Countermeasures
Quirks: Parameter Entities are not processed within EntityValue

defusedxml.*

No attacks possible

.NET

XmlReader

No attacks possible

XmlDocument

DoS attacks (a built-in threshold limits the size to 10 MB) - Apply an XmlReader
XXE/XXEP/URL Invocation - Apply an XmlReader

PHP

XMLReader

No attacks possible
Quirks: parser features != libxml2 features

SimpleXML

DoS attacks - No Countermeasures

DOMDocument

DoS attacks - No Countermeasures

Perl

XML::Twig

DoS/XXE attacks - Set the feature NoExpand
Quirks: Effectiveness of features depends on case-sensitivity and context

XML::LibXml

DoS attacks - No countermeasures available
Vulnerable to XXE/XXEP/URL Invocation - Set the feature load_ext_dtd = false

Java

Crimson

DoS attacks - Apply a DeclHandler
XXE/XXEP/URL Invocation attacks - Apply an EntityResolver
URL Invocation attacks - Apply an EntityResolver
Quirks: The features external-general-entities and external-parameter-entities cannot be set. (always true)

Piccolo

DoS attacks - Apply a DeclHandler
XXE/XXEP/URL Invocation attacks - Apply an EntityResolver
Quirks: The state of the feature external-parameter-entities is reported incorrectly.

Xerces SAX/DOM

DoS attacks - Apply a DeclHandler
XXE/XXEP/URL Invocation attacks - Apply an EntityResolver
Information: use the feature disallow-doctype-decl = false as a countermeasure for all attacks.

Oracle SAX/DOM

DoS attacks - Apply a DeclHandler
XXE/XXEP/URL Invocation attacks - Apply an EntityResolver
Quirks: The features external-general-entities and external-parameter-entities are not supported.

Authors of this Post

Christopher Späth
Christian Mainka (@CheariX)
Vladislav Mladenov

XML Parser Evaluation