XXE: when the XML parser fetches for the attacker

Definitions follow OWASP and CWE-611.

XML lets a document declare entities, named pieces of content, in a document type definition at the top. An external entity takes its content from a URI. If the parser resolves it, the content of that URI becomes part of the document.

An attacker who can send XML declares an external entity pointing at a file on the server or an internal address, and references it in a field the application returns. The application parses the document, and the response contains the file. The same mechanism makes the server request internal URLs, which is a form of SSRF.

• Reading files. Configuration files and keys on the server, returned in the response.
• Reaching internal systems. The parser requests internal URLs, as in server-side request forgery.
• Blind data exfiltration. With no output, the entity sends data to a server the attacker controls.
• Denial of service. Entities that expand into other entities, many levels deep, exhaust memory.

Many teams do not know they parse XML at all: office documents, SVG images and some single sign-on protocols are XML underneath.

Imagine an endpoint that accepts an order as XML and replies with a confirmation that repeats the customer's name. The parser behind it was left with its defaults, which in older libraries include resolving external entities.

An attacker sends an order whose document type definition declares an entity pointing at a configuration file on the server, and puts a reference to that entity in the name field. The parser reads the file into the name, and the confirmation returns it. Turning off document type definitions in the parser makes the same request fail with an error instead.

The same request aimed at an internal address instead of a file turns the parser into a client for internal services, which is why XXE and SSRF are so often found together.

A document type declaration with an external entity in a request body is a recognisable structure, and rule sets match it. That covers direct XML APIs.

It misses XML packed inside other formats, such as a zipped office document, and encodings the filter does not decode. Since the fix is a parser setting, the filter is a stopgap while the setting is changed everywhere.

1. Disable DTDs entirely where you can. This removes external entities and entity expansion at once; the OWASP XXE Prevention Cheat Sheet lists the setting for each common parser.
2. Otherwise disable external entities and external DTDs. Both general and parameter entities.
3. Find every parser. Including libraries that read documents, images and SSO messages.
4. Prefer simpler formats such as JSON where you control both sides.
5. Keep XML libraries updated. Newer versions often have safer defaults.