COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-201

Serialized Data External Linking

An adversary creates a serialized data file (e.g. XML, YAML, etc...) that contains an external data reference. Because serialized data parsers may not validate documents with external references, there may be no checks on the nature of the reference in the external data. This can allow an adversary to open arbitrary files or connections, which may further lead to the adversary gaining access to information on the system that they would normally be unable to obtain.

Abstraction

Detailed

Typical severity

High

Likelihood of attack

High

Understand the attack

What is this attack pattern?

An adversary creates a serialized data file (e.g. XML, YAML, etc...) that contains an external data reference. Because serialized data parsers may not validate documents with external references, there may be no checks on the nature of the reference in the external data. This can allow an adversary to open arbitrary files or connections, which may further lead to the adversary gaining access to information on the system that they would normally be unable to obtain.

Execution flow

How does the attack proceed, step by step?

1

Explore

Survey the target

Using a browser or an automated tool, an adversary records all instances of web services that process requests with serialized data.

Techniques used

  • Use an automated tool to record all instances of URLs that process requests with serialized data.
  • Use a browser to manually explore the website and analyze how the application processes serialized data requests.
2

Exploit

Craft malicious payload

The adversary crafts malicious data message that contains references to sensitive files.

Launch an External Linking attack

Send the malicious crafted message containing the reference to a sensitive file to the target URL.

Requirements

What does the attack require?

Prerequisites

  • The target must follow external data references without validating the validity of the reference target.

Skills required

  • Low: To send serialized data messages with maliciously crafted schema.

Resources required

  • None: No specialized resources are required to execute this type of attack.

Impact

What does a successful attack lead to?

Read Data

Affected scopes: Confidentiality

Defence

How is it prevented and mitigated?

1
Configure the serialized data processor to only retrieve external entities from trusted sources.

Real world

MITRE example instances

Example instance 1Detail
The following DTD would attempt to open the /dev/tty device: <!DOCTYPE doc [ <!ENTITY ent SYSTEM "file:///dev/tty"> ]> A malicious actor could use this crafted DTD to reveal sensitive information.
Example instance 2Detail
The following XML snippet would attempt to open the /etc/passwd file: <foo xmlns:xi="http://www.w3.org/2001/XInclude"> <xi:include parse="text" href="file:///etc/passwd"/></foo>