Vulnerability field guide

XML External Entity

An XML parser that resolves external entities will fetch any file or URL an attacker names. Here is how XXE turns a document upload into local file disclosure and SSRF, and the parser settings that stop it cold.

4 articles18 min totalOverview to advanced techniques
Start here<!ENTITY x SYSTEM "file:///etc/passwd">
Step 01 · Start with the overview
XML External Entity3 min read

XML External Entity (XXE): How a Parser Reads /etc/passwd For You

An XML parser that resolves external entities will fetch any file or URL an attacker names. Here is how XXE turns a document upload into local file disclosure and SSRF, and the parser settings that stop it cold.

Read the overview
Continue the field guide

XML External Entity techniques

3 focused deep-dives
  1. 02Blind / Out-of-BandBlind XXE: Exfiltrating Files With Out-of-Band Parameter Entities5 min
  2. 03Denial of ServiceBillion Laughs: Denial of Service Through XML Entity Expansion5 min
  3. 04File-Backed FormatsXXE in File Uploads: SVG, DOCX and Other XML-Backed Formats5 min