XXE Explained

XXE, XML external entity injection, abuses an XML parser that resolves external entities to read local files, reach internal systems, or exfiltrate data. It exists because many parsers resolve external entities by default. The fix is one configuration change: tell the parser not to.

What XXE is

XML lets a document define entities, including external ones that point to a file or URL. If an application parses attacker supplied XML with a parser that resolves those, the attacker can make it fetch files or URLs the application can reach.

Reading local files

The classic payload defines an entity pointing at a local file and echoes it back:

<?xml version="1.0"?>
<!DOCTYPE x [ <!ENTITY f SYSTEM "file:///etc/passwd"> ]>
<data>&f;</data>

If the response reflects the parsed content, the file contents come back.

XXE to SSRF

Point the entity at an internal URL instead of a file and the server fetches it, giving you server side request forgery. In cloud environments this can reach the metadata service and leak credentials, the same escalation described in SSRF explained.

Blind and out of band

When nothing is reflected, XXE is still exploitable. An out of band payload makes the parser call a server you control, confirming the vulnerability and, with a crafted external DTD, exfiltrating file contents through the callback.

Where to test for it

• Any endpoint that accepts XML
• File uploads that parse XML formats, including some document and image formats
• SOAP APIs
• Anything that switched from JSON to XML on request

The fix

Disable external entity resolution in the XML parser. Every major language has a one line way to do it. If XML is not needed, use JSON. That is the entire remediation.

# conceptually: disable DTDs and external entities
parser.setFeature(DISALLOW_DOCTYPE, true)

Practise this

XXE is satisfying because the payload is compact and the impact is large. Practise on vulnerable apps on Hacklido.