Skip to content

XML External Entity (XXE) Injection

XML External Entity (XXE) Injection

Description

XXE (XML External Entity) injection is a critical security flaw that arises when an application parses XML input from untrusted sources without proper validation. Attackers exploit this vulnerability by injecting external entities into the XML data, potentially leading to unauthorized access to sensitive files or directories on the server, such as /etc/passwd. This breach can enable adversaries to extract confidential information, disrupt application functionality, or execute arbitrary code. XXE vulnerabilities commonly occur due to lax input validation and the misconfiguration of XML parsers, allowing malicious entities to manipulate XML structures.

Examples

Java

//Input example : 
String xmlInput = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
    "<!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///etc/passwd\">]>\n" +
    "<foo>&xxe;</foo>";

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new ByteArrayInputStream(xmlInput.getBytes()));

// Process the XML document
// Access the parsed data, which could potentially include sensitive information

Javascript

const app = require("express")();
const libxml = require("libxmljs");
app.post("/path", (req, res) => {
  Element = libxml.parseXml(req.body, { noent: true });
 // Processing the XML element
});

Php

<?php
$xmlInput = '<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<foo>&xxe;</foo>';

$doc = new DOMDocument();
$doc->loadXML($xmlInput);

echo $doc->saveXML();
?>

Recommendation

To mitigate the risk of XML external entities vulnerabilities, it is recommended to:

  • Disable resolution of external entities.
  • Disable support for XInclude. 
//Input example : 
String xmlInput = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
    "<!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///etc/passwd\">]>\n" +
    "<foo>&xxe;</foo>";

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

// Enable secure processing mode to mitigate common XML security vulnerabilities
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

// Disable external DTDs and stylesheets to prevent potential XXE attacks
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new ByteArrayInputStream(xmlInput.getBytes()));

const app = require("express")();
const libxml = require("libxmljs");
app.post("/path", (req, res) => {
  Element = libxml.parseXml(req.body);
 // Processing the XML element
});

<?php
$loadEntities = libxml_disable_entity_loader(true);

$xmlInput = '<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<foo>&xxe;</foo>';

$doc = new DOMDocument();
$doc->loadXML($xmlInput);

libxml_disable_entity_loader($loadEntities);

echo $doc->saveXML();
?>

Standards

  • CWE_TOP_25:
    • CWE_611
  • GDPR:
    • ART_25
    • ART_32
  • PCI_STANDARDS:
    • REQ_6_4
    • REQ_6_5
  • SOC2_CONTROLS:
    • CC_2_1
    • CC_3_4
    • CC_4_1
    • CC_7_1
    • CC_7_2
    • CC_7_4
    • CC_7_5