What are XML External Entity (XXE) vulnerabilities?

XXE vulnerabilities are based on the external entities in XML documents. Attackers can exploit them to take advantage of the parser's ability to interpret external entities.

The attack becomes effective if the parser unconditionally accepts references to these external entities, as attackers integrate their own entities capable of performing diverse and highly malicious operations.

This includes not only accessing local or remote files but also initiating requests to the server and causing a denial of service through resource exhaustion.

XXE opens up an opportunity for various attacks, from extracting data to performing complex manipulations. Let's review the main threats:

Resource exhaustion attacks

Resource exhaustion attacks via XXE are based on creating manipulative external entities designed to cause an overload of system resources. This is achieved by activating resource-intensive operations that lead to denial of service due to excessive resource consumption, making them effective means of destabilizing the target system.

Data extraction attacks

XXE vulnerabilities open the door to data extraction attacks, where attackers use external entities to read sensitive information from a system. By referencing external entities pointing to specific files, attackers extract sensitive data, posing a serious threat to data privacy on the target system.

SSRF attacks

XXE can be used to provoke SSRF attacks, where manipulative entities stimulate an application to perform requests to arbitrary addresses. This opens the potential for unauthorized access to internal resources and services. Attackers actively exploit this vector to bypass network restrictions and extract information from internal systems.

Blind XXE

In blind XXE attacks, attackers successfully exploit a vulnerability without requiring direct inference. They accomplish this by introducing manipulative entities that cause changes in application behavior. Such attacks allow intruders to validate the vulnerability even without explicit feedback, making such attacks more difficult to detect.

There are several reliable ways to prevent most XXE attacks. Let's look at some of them:

Manual XXE prevention

Developers must carefully validate and clean XML input to identify and reject malicious entities. This manual approach involves rigorous input validation, ensuring that only trusted XML content is processed.

Disabling DTD support or using local DTDs only

Disabling support for DTDs or restricting their use to local files helps prevent XXE vulnerabilities. This ensures that external entities are not included in untrusted sources.

Application server instrumentation

An application server to monitor and block malicious XML input improves security. Implementing server controls helps detect and prevent XXE attacks in real time.

Managed WAF with customizable rules

A web firewall with customizable rules to detect and block XXE patterns provides an additional layer of protection. Whilst managed WAF solutions dynamically adapt to changing threats.