Xml External Entities with Bearer Tokens

Detecting XXE vulnerabilities in Bearer Tokens systems requires specialized scanning that understands the authentication flow context. middleBrick's scanner specifically targets these Bearer Tokens scenarios:

middleBrick's Bearer Tokens-specific XXE detection includes:

middlebrick scan https://api.example.com/oauth2/introspect \
  --test-suite=xxe \
  --payload-type=xml \
  --auth-scheme=bearer

The scanner automatically tests for:

• Local file access attempts through crafted XML entities
• Network-based exfiltration using the introspection server's network context
• Denial of service through exponential entity expansion
• Parameter entity injection in XML processing pipelines

Key indicators that middleBrick detects include:

{
  "findings": [
    {
      "type": "XXE_BEARER_TOKEN",
      "severity": "critical",
      "location": "/oauth2/introspect",
      "description": "XML External Entity vulnerability in token introspection endpoint",
      "remediation": "Disable external entity resolution in XML parser configuration",
      "evidence": "Successful retrieval of /etc/passwd via crafted XML payload"
    }
  ]
}

Remediating XXE vulnerabilities in Bearer Tokens systems requires both immediate patches and architectural changes. Here are Bearer Tokens-specific fixes:

1. XML Parser Configuration

// Vulnerable Java code
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xml)));

// Secure Bearer Tokens-specific fix
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xml)));

2. Token Introspection Hardening

# Vulnerable Flask endpoint
@app.route('/oauth2/introspect', methods=['POST'])
def introspect():
    data = request.get_data()
    doc = ET.fromstring(data)  # Vulnerable to XXE
    return process_introspection(doc)

# Secure Bearer Tokens-specific implementation
def secure_introspect():
    data = request.get_data()
    parser = ET.XMLParser()
    parser.parser.UseForeignDTD(False)
    parser.parser.SetLoadExternalEntities(False)
    doc = ET.fromstring(data, parser=parser)
    return process_introspection(doc)

3. Input Validation and Sanitization

// Bearer Tokens-specific XML sanitizer
func sanitizeXML(input []byte) ([]byte, error) {
    config := s9y.NewConfiguration()
    config.RemoveComments = true
    config.RemoveProcInst = true
    config.RemoveElements = []string{"!ENTITY", "!DOCTYPE"}
    
    sanitized, err := s9y.Sanitize(input, config)
    if err != nil {
        return nil, err
    }
    return sanitized, nil
}

// Usage in token processing
func processBearerToken(xmlPayload []byte) (*Token, error) {
    sanitized, err := sanitizeXML(xmlPayload)
    if err != nil {
        return nil, fmt.Errorf("input sanitization failed: %v", err)
    }
    return parseTokenXML(sanitized)
}

4. Network Layer Protection

# Bearer Tokens-specific Nginx configuration
location /oauth2/introspect {
    # Block XML external entity processing
    proxy_set_header X-Content-Type-Options "nosniff";
    
    # Rate limiting to prevent DoS via entity expansion
    limit_req zone=api_limit burst=10 nodelay;
    
    # Content security policy for XML processing
    add_header X-Permitted-Cross-Domain-Policies "none";
    
    # Only allow safe content types
    if ($content_type != 'application/xml' && $content_type != 'text/xml') {
        return 415;
    }
    
    proxy_pass http://introspection_backend;
}