Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Improve XML External Entity (XXE) detection

Abierto
  • ¿Algo no está bien?
#47 63 comentarios 3 reacciones 1 asignado Ver en GitHub

@azurit ya está trabajando en esto.

Desde el 27/4/2024.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

Motivation

I could be wrong but as far as I can tell, the XML External Entity (XXE) protection offered by CRS is fairly poor. There have been multiple attempts in the past to address these shortcomings but they have not succeeded and there are currently no ongoing efforts to improve the situation.

These are the issues and pull requests that have been created in the past:

From the discussions in the tickets and pull requests above, the problem appears to be that there is a shortcoming of ModSecurtiy which causes the targeted collections (REQUEST_BODY and FULL_REQUEST) to be empty if a body parser has been activated. This, of course, would be the case in most situation where XXE detection is desired, braking the proposed rules.

However, since the information related to XXEs is contained in <!DOCTYPE ...> tags, which are not accessible through the XML collection using XPath expressions, is not possible to write reliable ModSecurity rules to detect XXEs for these requests.

This issue is known but considering the following discussion, it is unlikely to be fixed in ModSecurity any time soon: https://github.com/SpiderLabs/ModSecurity/issues/2087.

There have been comments that a plugin leveraging ModSecurity's Lua capabilities might help but as far as I can tell, this was never implemented: https://github.com/coreruleset/coreruleset/pull/2163#issuecomment-997432471.

Proposed solution

Implement a plugin similar to the antivirus plugin which can reliably detect XXEs in requests independently of whether or not a body parser has been activated.

Alternatives

A cleaner approach might be to create a pull request to ModSecurity to provide additional information about the payload like the DOCTYPE through either the existing XML collection or through a new collection. This would allow for regular rules to be written in order to detect XXEs. However, this would require a change to ModSecurity, which is outside the control of the Core Rule Set Project.

Additional context

There is a ModSecurity directive related to XXEs: SecXmlExternalEntity. This directive is turned off by default. From what I understand, this directive only configures whether ModSec expands External Entities in XML or not. It does not configure whether XXEs are allowed in general or not. XML containing XXEs are not blocked, even if SecXmlExternalEntity is turned off.

There are rules that might detect XXEs in certain circumstances, however, this is mostly incidental as they do not explicitly check for XXEs.

Lenguaje dominante
Python
Estrellas
53
Forks
13
Merge medio
7 h 30 min
PR fusionados (30 d)
1

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de coreruleset/plugin-registry

Todos los issues de coreruleset/plugin-registry

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.