What Is XXE Injection? How to Test XML External Entity Bugs
XXE means XML External Entity injection.
If an app parses XML and allows external entities, attackers may read local files, trigger SSRF-like fetches, or cause denial of service — depending on the parser and defenses.
Quick takeaway: Find XML input → see if external entities resolve → prefer OOB proofs on live targets → remember “hidden XML” inside Office docs and SVGs.
XXE in one friendly example
XML can define entities. A vulnerable parser may fetch a URL or local path while expanding them.
That is why XXE shows up in:
- SOAP APIs
- SAML flows
- Document converters
- SVG image uploads
- DOCX/XLSX imports (ZIP archives containing XML)
Hunting map
Ask: “Where does this product parse XML?”
Then check features that do not look like XML at first glance — file imports especially.
Safe testing mindset
In labs
Practice classic file read and OOB techniques on PortSwigger XXE labs until the mechanics feel boring.
On real programs
- Prefer out-of-band callbacks over dumping
/etc/passwdwhen policy is strict - Keep payloads minimal
- Document parser behavior and blocked DTDs honestly
Impact language that works
Weak: “XXE exists.”
Strong: “The invoice import parser resolves external entities, so a crafted document can make the server fetch attacker-controlled URLs.”
Fixes to recommend
- Disable external entities / DTD resolution
- Use less powerful parsers when possible
- Validate and sanitize uploads before parsing
- Treat Office/SVG uploads as untrusted XML surfaces
Original Bugflare article. Concepts aligned with PortSwigger XXE academy content. Stay in scope.