[B! XML] ionisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ionis id:ionis

XMLã«é–¢ã™ã‚‹ionisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

XXEæ”»æ’ƒ åŸºæœ¬ç·¨ | æŠ€è¡“è€…ãƒ–ãƒã‚° | ä¸‰äº•ç‰©ç”£ã‚»ã‚ãƒ¥ã‚¢ãƒ‡ã‚£ãƒ¬ã‚¯ã‚·ãƒ§ãƒ³æ ªå¼ä¼šç¤¾
å…ˆæ—¥ OWASP Top 10 - 2017 ãŒã¤ã„ã«å…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ ã“ã®OWASP Top 10 ã¨ã¯ã€OWASP Top Ten ProjectãŒæœ€ã‚‚é‡å¤§ã¨è€ƒãˆã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒªã‚¹ã‚¯ã® Top 10ã‚’ã¾ã¨ã‚ãŸã‚‚ã®ã§ã™ã€‚å¤‰æ›´ç‚¹ã¯ã„ãã¤ã‹ã‚ã‚Šã¾ã™ãŒã€ä»Šå›žOWASP Top 10 - 2017 ã®ä¸ã«XXE(XML External Entity)ãŒãƒ©ãƒ³ã‚¯ã‚¤ãƒ³ã—ã¦ã„ã¾ã—ãŸã€‚ XXEã‚’ç”¨ã„ãŸæ”»æ’ƒï¼ˆä»¥é™ XXEæ”»æ’ƒï¼‰ã¯ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç•Œéšˆã«ãŠã„ã¦ã¯ã€ã‹ãªã‚Šæ˜”ã‹ã‚‰çŸ¥ã‚‰ã‚Œã¦ã„ã‚‹æ”»æ’ƒæ‰‹æ³•ã§ã™ãŒã€é–‹ç™ºè€…ç‰ã«ã¯ã‚ã¾ã‚ŠèªçŸ¥ã•ã‚Œã¦ã„ãªã„ã¨æ€ã‚ã‚Œã¾ã™ã®ã§ã€ã‚ã‚‰ãŸã‚ã¦ã“ã®XXEæ”»æ’ƒã«ã¤ã„ã¦è§£èª¬ã‚’è¡Œã£ã¦ã„ãã¾ã™ã€‚ ä»Šå›žè§¦ã‚Œã¦ã„ãªã„æ”»æ’ƒæ‰‹æ³•ã«ã¤ã„ã¦ã¯ã€ã¾ãŸã®æ©Ÿä¼šã«ç´¹ä»‹ã‚’ã—ãŸã„ã¨æ€ã£ã¦ã„ã¾ã™ã€‚ XXEã¨ã¯ XXEã¨ã¯ XML External Entity ã®ç•¥ç§°ã§ã‚ã‚Šã€å¤–éƒ¨å®Ÿä½“å‚ç…§ã‚’åˆ©ç”¨ã—ãŸè„†å¼±æ€§ã‚’æŒ‡ã—ã¾ã™ã€‚ ãŸã ã—ã€
ionis 2018/10/23
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XML

XXE
ãƒªãƒ³ã‚¯
CVE-2014-8080: REXML ã«ãŠã‘ã‚‹XMLå±•é–‹ã«ä¼´ã†ã‚µãƒ¼ãƒ“ã‚¹ä¸èƒ½æ”»æ’ƒã«ã¤ã„ã¦
Posted by nagachika on 27 Oct 2014 REXML ã«ãŠã„ã¦ XML ã®ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã‚¨ãƒ³ãƒ†ã‚£ãƒ†ã‚£ã®å±•é–‹ã«ã‚ˆã‚Šã‚µãƒ¼ãƒ“ã‚¹ä¸èƒ½æ”»æ’ƒãŒå¯èƒ½ã¨ãªã‚‹è„†å¼±æ€§ãŒå ±å‘Šã•ã‚Œã¾ã—ãŸã€‚ ã“ã®è„†å¼±æ€§ã¯ CVE-2014-8080 ã¨ã—ã¦ CVE ã«ç™»éŒ²ã•ã‚Œã¦ã„ã¾ã™ã€‚ ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®çš†ã•ã‚“ã«ã¯ Ruby ã‚’æ›´æ–°ã™ã‚‹ã“ã¨ã‚’å¼·ããŠå‹§ã‚ã—ã¾ã™ã€‚ è©³ç´° XMLãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã‹ã‚‰ãƒ†ã‚ã‚¹ãƒˆã®ãƒŽãƒ¼ãƒ‰ã‚’èªã¿è¾¼ã‚€éš›ã«REXMLãƒ‘ãƒ¼ã‚µãƒ¼ã«æ¥µã‚ã¦å¤§ããª String ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã‚’ç”Ÿæˆã•ã›ã‚‹ã“ã¨ã§ã€ãƒžã‚·ãƒ³ä¸Šã®ãƒ¡ãƒ¢ãƒªã‚’ä½¿ã„æžœãŸã•ã›ã¦ã‚µãƒ¼ãƒ“ã‚¹ä¸èƒ½æ”»æ’ƒ(DoS)ã‚’æˆç«‹ã•ã›ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ å½±éŸ¿ã‚’å—ã‘ã‚‹ã®ã¯ä»¥ä¸‹ã®ã‚ˆã†ãªã‚³ãƒ¼ãƒ‰ã§ã™: require 'rexml/document' xml = <<XML <!DOCTYPE root [ # ENTITY expansion vector ]> <cd></cd> XML
ionis 2017/04/12
ruby

è„†å¼±æ€§

XML

REXML
ãƒªãƒ³ã‚¯
Ronin - Rails PoC exploits for CVE-2013-0156 and CVE-2013-0155
TL;DR: Exploits are out, update Rails! rails_dos.rb rails_jsonq.rb rails_sqli.rb rails_rce.rb On January 8th, Aaron Patterson announced CVE-2013-0156, multiple vulnerabilities in parameter parsing in Action Pack allowing attackers to: Bypass Authentication systems Inject Arbitrary SQL Perform a Denial of Service (DoS) Execute arbitrary code However, rumors of this vulnerability had been circulatin
ionis 2014/11/10
Ruby on Rails

è„†å¼±æ€§

XML
ãƒªãƒ³ã‚¯
XMLã€€ï¼XMLæ–‡æ›¸ã®æ§‹æ–‡ï¼
â– ã€€ï¼¸ï¼ï¼¬å®£è¨€ã®åŸºæœ¬ ï¼¸ï¼ï¼¬å®£è¨€ã¯ãã®ãƒ•ã‚¡ã‚¤ãƒ«ãŒxmlã§è¨˜è¿°ã•ã‚Œã¦ã„ã‚‹ã“ã¨ã‚’XMLãƒ‘ãƒ¼ã‚µã«æŒ‡ç¤ºã™ã‚‹ãŸã‚ã® ã‚‚ã®ã§ã€åŠè§’å°æ–‡å—ã§æ›¸ãã¾ã™ã€‚ ä¸‹è¨˜ãŒæœ€ã‚‚åŸºæœ¬çš„ãªå½¢ã®å®£è¨€ã§ã€ã€Œxmlã€ãŒã€ŒXMLã€ã¨ã„ã†ã‚ˆã†ã«å¤§æ–‡å—ã«ãªã£ã¦ã‚‚ã€ ã€Œ<?ã€ã¨ã€Œxmlã€ã®é–“ã«ã‚¹ãƒšãƒ¼ã‚¹ãŒå…¥ã£ã¦ã‚‚ã‚¨ãƒ©ãƒ¼ã¨ãªã‚Šã¾ã™ã€‚ <?xml version="1.0"?> â– ã€€versionå±žæ€§ ã€Œversion1.0ã€ã¯xmlã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’æŒ‡å®šã—ã¾ã™ã€‚åŠè§’å°æ–‡å—ä»¥å¤–ã§è¨˜è¿°ã™ã‚‹ã¨ ã‚¨ãƒ©ãƒ¼ã«ãªã‚Šã¾ã™ã€‚ XML1.1 XML1.1ã‚’å®Ÿè£…ã—ãŸã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãŒç™ºè¡¨ã•ã‚Œã‚Œã°ã€versionå±žæ€§ã«ã€Œ1.1ã€ã‚’æŒ‡å®šã™ã‚‹ã“ã¨ã«ãªã‚Šã¾ã™ã€‚ äº’æ›æ€§ç¶æŒã®ãŸã‚ã«ã€Œversion1.0ã€ã¨è¨˜è¿°ã—ãŸã‚‚ã®ã‚‚åŒã˜ã‚ˆã†ã«æ‰±ãˆã‚‹ã‚ˆã†ã«ã™ã‚‹ã“ã¨ãŒXML1.1ã®ä»•æ§˜æ›¸ ã«ã¯æ˜Žè¨˜ã•ã‚Œã¦ã„ã¾ã™ã€‚ <?xml version="1.0" encoding="SHIFT_JIS
ionis 2008/06/13
XML

è§£èª¬
ãƒªãƒ³ã‚¯
1

ãŠçŸ¥ã‚‰ã›

ã‚‚ã£ã¨èªã‚€

å…¬å¼Twitter

@hatebu
æœ€æ–°ã®äººæ°—ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã®é…ä¿¡

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

jæ¬¡ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kå‰ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

lã‚ã¨ã§èªã‚€

eã‚³ãƒ¡ãƒ³ãƒˆä¸€è¦§ã‚’é–‹ã

oãƒšãƒ¼ã‚¸ã‚’é–‹ã

è¨å®šã‚’å¤‰æ›´ã—ã¾ã—ãŸx

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (7)

XMLã«é–¢ã™ã‚‹ionisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

ãŠçŸ¥ã‚‰ã›

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2026å¹´2æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2026å¹´3æœˆç¬¬1é€±ï¼‰

ã€iOSã‚¢ãƒ—ãƒªã€‘ã‚¢ãƒ—ãƒªã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã®ãŠçŸ¥ã‚‰ã›ï¼šç‰¹å®šç”»é¢ã§ã‚¢ãƒ—ãƒªãŒå¿œç”ã—ãªããªã‚‹å•é¡Œã‚’ä¿®æ£ã—ã¾ã—ãŸ

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (7)

XMLã«é–¢ã™ã‚‹ionisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

XXEæ”»æ’ƒ åŸºæœ¬ç·¨ | æŠ€è¡“è€…ãƒ–ãƒ­ã‚° | ä¸‰äº•ç‰©ç”£ã‚»ã‚­ãƒ¥ã‚¢ãƒ‡ã‚£ãƒ¬ã‚¯ã‚·ãƒ§ãƒ³æ ªå¼ä¼šç¤¾

CVE-2014-8080: REXML ã«ãŠã‘ã‚‹XMLå±•é–‹ã«ä¼´ã†ã‚µãƒ¼ãƒ“ã‚¹ä¸èƒ½æ”»æ’ƒã«ã¤ã„ã¦

Ronin - Rails PoC exploits for CVE-2013-0156 and CVE-2013-0155

XMLã€€ï¼XMLæ–‡æ›¸ã®æ§‹æ–‡ï¼

ãŠçŸ¥ã‚‰ã›

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2026å¹´2æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2026å¹´3æœˆç¬¬1é€±ï¼‰

ã€iOSã‚¢ãƒ—ãƒªã€‘ã‚¢ãƒ—ãƒªã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã®ãŠçŸ¥ã‚‰ã›ï¼šç‰¹å®šç”»é¢ã§ã‚¢ãƒ—ãƒªãŒå¿œç­”ã—ãªããªã‚‹å•é¡Œã‚’ä¿®æ­£ã—ã¾ã—ãŸ

å…¬å¼Twitter

ã‚­ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (7)

XMLã«é–¢ã™ã‚‹ionisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

XXEæ”»æ’ƒ åŸºæœ¬ç·¨ | æŠ€è¡“è€…ãƒ–ãƒã‚° | ä¸‰äº•ç‰©ç”£ã‚»ã‚ãƒ¥ã‚¢ãƒ‡ã‚£ãƒ¬ã‚¯ã‚·ãƒ§ãƒ³æ ªå¼ä¼šç¤¾

CVE-2014-8080: REXML ã«ãŠã‘ã‚‹XMLå±•é–‹ã«ä¼´ã†ã‚µãƒ¼ãƒ“ã‚¹ä¸èƒ½æ”»æ’ƒã«ã¤ã„ã¦

XMLã€€ï¼XMLæ–‡æ›¸ã®æ§‹æ–‡ï¼

ãŠçŸ¥ã‚‰ã›

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2026å¹´2æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2026å¹´3æœˆç¬¬1é€±ï¼‰

ã€iOSã‚¢ãƒ—ãƒªã€‘ã‚¢ãƒ—ãƒªã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã®ãŠçŸ¥ã‚‰ã›ï¼šç‰¹å®šç”»é¢ã§ã‚¢ãƒ—ãƒªãŒå¿œç”ã—ãªããªã‚‹å•é¡Œã‚’ä¿®æ£ã—ã¾ã—ãŸ

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹