Web SecurityHighXML eXternal Entity

XML External Entities (XXE)

An XML parser configured to resolve external entities lets attackers read files, perform SSRF, or cause denial of service.

Overview

If the parser processes DOCTYPE/ENTITY declarations, an attacker-defined external entity can reference local files or internal URLs, which are then included in the parsed output or used as a blind SSRF primitive.

How it works

Example

xml

<?xml version="1.0"?>
<!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]>
<r>&x;</r>

Impact

Local file disclosure, SSRF to internal services, and denial of service via entity expansion (billion laughs).

Detection

Submit benign external-entity probes (OAST + harmless file refs) into every XML/SVG/DOCX intake and watch for inclusion or callbacks.

Prevention

Disable DTDs and external entity resolution in the XML parser.
Prefer JSON, or use hardened parser configurations.
Validate and sandbox file-upload formats that wrap XML (SVG, DOCX, XLSX).

Real-world HackerOne reports

Sampled from 20 disclosed reports analyzed for the XML External Entities (XXE) research playbook.

#1095645 #1156748 #1217114 #1218708 #1321070 #227880 #2299069 #2573567