xxe

XML External Entity Detection

Overview

XML external entity injection lets an attacker interfere with how an application parses XML. By supplying a document type definition that declares an external entity, the attacker makes the parser dereference a resource of their choosing — a local file, an internal or external URL, or another target the parser can open — and, where the parsed value is reflected or an error is returned, read it back. It sits at the point in the request lifecycle where the server hands attacker-supplied bytes to an XML parser: a request body, an uploaded document, or a format that is quietly XML underneath. The attacker is usually an unauthenticated remote user, and the parser acts with the application's own privileges, so a successful entity reference reads configuration files, credentials, and source code, or turns the parser into an HTTP client aimed at internal services and cloud metadata. Even where nothing is reflected, a hosted definition or a verbose parser error carries the data back out of band. This skill finds it by locating every parser instantiation and every path that feeds one untrusted XML, checking each site in parallel, and merging the results into <output_dir>/xxe-results.md.

What it is NOT

• Server-side request forgery (/websec:ssrf): a URL-fetching feature with no XML parser on the path is plain SSRF. Test: is the request issued by an XML parser resolving an entity, or by an HTTP client the code called directly? Entity-driven outbound requests are this class; record the SSRF pivot in Impact.
• Path traversal (/websec:path-traversal): a path parameter reaching a file read is traversal. Test: does the attacker control a path argument, or an entity declaration? Both read files; the sink and the fix differ.
• File upload (/websec:file-upload): unrestricted storage or serving of an uploaded file is that class. Test: is the problem where the file lands, or that its contents are parsed as XML with entities enabled? An SVG or Office document parsed server-side belongs here.
• Information disclosure (/websec:information-disclosure): verbose parser errors returned to clients are their own finding. Here they are an exfiltration channel — note the error handling, keep the parser judgement separate.
• Unsafe deserialization (/websec:deserialization): an XML-based object serializer that reconstructs arbitrary types executes code through type resolution, not entity resolution. Test: does the payload declare an entity, or name a class to instantiate?
• Not a finding: a parser explicitly configured to reject document type declarations; a library that does not implement external entities at all; XML built entirely by the server and never parsed from input; built-in entity references such as the escaped angle bracket, which are ordinary XML; schema or fixture files in the repository that no request path parses.