XXE: XML External Entity Injection and the One-Line Fix

XML has a feature that lets a document define entities — shorthand names expanded when the document is parsed — and an entity may be external, meaning its content is fetched from a URI when the parser expands it. A parser that honours that feature on untrusted input will fetch whatever the attacker names, which is the whole vulnerability.

What it enables

Local file disclosure. An external entity referencing a file path causes the parser to read that file and insert its contents into the document, which the application then processes and frequently echoes back. Configuration files with database credentials, private keys and system files are the usual targets.

Server-side request forgery. An entity referencing a URL makes the server issue that request, from inside the network. That reaches internal services and, in cloud environments, the instance metadata endpoint that returns temporary credentials — the escalation described under SSRF. XXE is one of the most common ways SSRF is reached.

Denial of service. The "billion laughs" attack defines nested entities that each reference the previous one several times, so expansion grows exponentially and exhausts memory from a small input. No external fetch is required, so it works even where external entities are disabled but expansion limits are not set.

Blind XXE. Where the application returns nothing useful, the attacker uses out-of-band techniques — an entity pointing at a domain they control confirms the parse happened and can carry file contents out through the request itself.

Where it hides

The obvious case is an endpoint accepting XML directly. The cases that get missed are more interesting.

Document and image formats are XML underneath — office documents, SVG, and many configuration and data interchange formats. An application that accepts an uploaded document or renders an uploaded image may be parsing attacker-controlled XML without anyone thinking of it that way.

SOAP services, SAML assertions, RSS and Atom feeds, and XML-based configuration all parse untrusted XML. SAML is a particularly sensitive case, because the parser sits directly in the authentication path — one reason the federation protocols warrant careful library choice.

Content type confusion catches applications too: an endpoint documented as accepting JSON may fall back to XML parsing if the request declares an XML content type, and the XML path was never reviewed.

The fix

Disable document type definitions entirely in the parser configuration. That single change removes external entities, parameter entities and entity expansion at once, and almost no application legitimately needs DTDs.

Where DTDs cannot be disabled, disable external general and parameter entities specifically, and set entity expansion limits to stop the exponential case.

The critical detail is that this is per-parser and frequently insecure by default, particularly in older library versions. An application using three different XML parsers in three code paths needs all three configured, and the one nobody remembered is the vulnerable one. Newer versions of most libraries default to safe behaviour, which is an argument for keeping them current rather than a reason to skip the configuration.

Supporting measures help without fixing it: validating input against a schema, running the application with an account that cannot read sensitive files, and restricting outbound network access so the SSRF branch reaches nothing interesting. A WAF blocks obvious payloads and is bypassed by encoding, so it buys time rather than closing the hole — the same position as with the other injection families.

Where the choice exists, preferring JSON avoids the entire class, since JSON has no equivalent feature.

Detection

Look for DOCTYPE declarations and ENTITY definitions in incoming XML, which legitimate application traffic rarely contains. Watch for outbound connections from application servers to unexpected destinations, and for DNS lookups of attacker-style domains originating from server infrastructure — the blind variant's signature. Application errors mentioning entity or DTD parsing are another signal, and both belong in your SIEM rather than in an application log nobody reads.

Exam angles

Define XXE as abuse of XML external entity expansion to read local files, reach internal services, or cause denial of service. Know that it is a leading route to SSRF and that the billion laughs attack is the expansion-based denial of service. Recognize that file uploads of office documents and SVG images can carry XXE. Name disabling DTD processing in the parser as the primary fix, note that safety is parser-specific and historically not the default, and know that JSON avoids the class entirely.