XXE Bug Bounty Guide: XML External Entity Attacks That Still Pay

XXE fires when an XML parser resolves external entities from attacker-controlled documents. You can read files, trigger SSRF, or sometimes deny service with billion laughs variants (skip DoS on production).

JSON ate a lot of XML, yet uploads, SAML, SOAP, office document parsers, and “import XML” features keep this class alive.

Where to send hostile XML

File upload that accepts .xml, .svg, .docx/.xlsx (zipped XML)
Content-Type application/xml or text/xml APIs
SOAP endpoints and XML-RPC
SAML AuthnRequest / response handling (often sensitive — check scope)
Content management “paste XML” tools

SVG is an underrated vector: many image pipelines still parse XML.

Testing progression

Start with a simple defined entity that reflects:

<!DOCTYPE foo [<!ENTITY xxe "bugflare-xxe">]>
<root>&xxe;</root>

If bugflare-xxe appears in the response or stored output, entity expansion works. Next, try external entities pointing at a collaborator URL. A DNS or HTTP hit proves out-of-band XXE even when file contents never return.

For file read, classic file:///etc/passwd (or platform equivalents) may be blocked. OOB channels or parameter entities often still work on older parsers. PortSwigger’s XXE labs cover the usual ladder — walk it before improvising on live targets.

SSRF through XXE

External entities that hit http://169.254.169.254/ or internal hosts are SSRF with an XML costume. Treat cloud metadata rules seriously; some programs forbid metadata access. Use a collaborator first.

Report contents

Exact upload or request
Parser behavior (reflected entity vs OOB only)
Data retrieved or callback evidence
Impact: file disclosure, internal network reachability, credential file reads

Avoid billion-laughs and entity bombs on shared infrastructure.

Hardening note

Disable external entities and DTD resolution in the parser config. Prefer non-XML formats when possible. For document pipelines, sanitize or re-encode through libraries that strip DTDs.

XXE is a parser-configuration bug dressed as a feature. Whenever an app accepts XML-shaped input, ask whether DTDs are dead — and if they are not, bring a collaborator and a calm file-read PoC.