A Study of XXE Attacks Prevention Using XML Parser Configuration

Online attacks are outcomes of cyber vulnerabilities. XML (eXtensible Markup Language) is a self-descriptive markup language, and XML eXternal Entity injection (XXE) is a well-recognised web security vulnerability. XXE injection can attack web applications that several popular XML parsers are unable to withstand. Most of the available literature on XXE is based on vulnerability testing, but not much work has been done on ways for prevention of such attacks. The aim of this research is investigation of XXE attacks, and ways of prevention of such attacks. A sample vulnerable web application utilizing the standard XML parser that accompanies the Java Development Kit (JDK) has been developed in this work for executing different attacks and detection of attacks. Additionally, ways for prevention of XXE attacks are suggested as well. A virtual machine image of the developed framework is provided to perform trial and error for experimentation and representation of vulnerabilities. Different techniques and exploitation approaches for evaluating the performance of sample web application in terms of vulner-abilities are utilized to develop a platform for executing such attacks. Since the vulnerabilities of misconfigured XML parsers are depicted in this work in detail, effective methods for securing websites from XXE attacks are provided. Furthermore, this work also includes discourse on tools for developing platform for XXE attacks, and ways to eliminate vulnerabilities.