Rajeev Pentyala – Microsoft Power Platform

We have a Web Service, which accepts ‘XML’ payload from client and processes.

Recently the ‘Web Service’ underwent Penetration testing (Also called ‘Ethical hacking’) and following vulnerability has been identified:

Reason:

• Our Web Service, processes the XML payload submitted by client using the following code snippet:

• We were not having XML payload validation in place.
• There is possibility that hacker can inject malicious content in the XML and can cause a denial of service condition, gain access to unauthorized information available on the server where the ‘Web Service’ was hosted.

Fix:

• We could fix the issue by setting ‘XmlResolver’ property to ‘Null’.
• External resources are resolved using the ‘XmlResolver’ provided via XmlDocument.XmlResolver property, by setting ‘XMlResolver’ to Null, XML Parser would not resolve the external resources, which prevents accessing external resources (i.e., Files in the Serer where Web Service hosted).
• Change the ‘XmlDocument’ object instantiation as below with ‘XmlResolver’ set to ‘Null’ solved our issue.

var xmlDocument = new XmlDocument { XmlResolver = null };

🙂