Xxe

XXE Detection

When to Use

Audit XML processing endpoints, SOAP services, document importers (DOCX/XLSX/SVG), and any code that parses XML from untrusted sources.

Key Distinction from Entity Expansion

• XXE = EXTERNAL entities (file://, http://) -- reads files or makes HTTP requests
• Entity expansion = INTERNAL entity recursion (Billion Laughs) -- memory exhaustion DoS

Both can exist in the same parser, but they are different vulnerabilities.

Process

Step 1: Find XML Parsers

# JavaScript
grep -rn "DOMParser\|XMLParser\|xml2js\|libxmljs\|xmldom\|sax\|saxes" .

# Python
grep -rn "xml\.etree\|lxml\|minidom\|xml\.sax\|defusedxml\|xmltodict" .

# Go
grep -rn "xml\.Decoder\|xml\.Unmarshal\|encoding/xml" .

# Java
grep -rn "DocumentBuilder\|SAXParser\|XMLReader\|TransformerFactory\|SchemaFactory" .

# PHP
grep -rn "simplexml\|DOMDocument\|XMLReader\|xml_parse" .

# Ruby
grep -rn "Nokogiri\|REXML\|Ox\|LibXML" .

Step 2: Check External Entity Configuration

grep -rn "FEATURE_SECURE_PROCESSING\|FEATURE_EXTERNAL_ENTITIES\|FEATURE_GENERAL_ENTITIES" .
grep -rn "resolve_entities\|external_entities\|load_external\|noent\|nonet" .
grep -rn "disallow-doctype-decl\|external-general-entities\|external-parameter-entities" .
grep -rn "XXE\|external.*entity\|doctype" .

Step 3: Check Default Safety

Most modern parsers are SAFE by default. Key exceptions:

| Parser | Default External Entities | Safe? | |--------|--------------------------|-------| | xml.etree (Python) | Enabled | UNSAFE | | xml.sax (Python) | Enabled | UNSAFE | | lxml (Python) | Disabled | SAFE | | defusedxml (Python) | Disabled | SAFE | | encoding/xml (Go) | No entity support | SAFE | | Nokogiri (Ruby) | Disabled | SAFE | | REXML (Ruby) | Enabled | UNSAFE | | libxml2 (C) | Depends on flags | CHECK | | Java DocumentBuilder | Enabled | UNSAFE | | PHP simplexml | Depends on libxml2 config | CHECK | | PHP DOMDocument | Depends on libxml2 config | CHECK |

Step 4: Verify User Input Reaches Parser

Does untrusted XML reach the parser? Common sources:

• File upload (XML, SVG, DOCX, XLSX)
• API request body (Content-Type: application/xml)
• Webhook payloads
• RSS/Atom feed processing
• SOAP requests

XXE Payloads

File Read

]>
&xxe;

SSRF

]>
&xxe;

Blind XXE (Out-of-Band)

  %xxe;
]>
test

CVSS Guidance

• File read (unauthenticated): HIGH 7.5
• SSRF via XXE: HIGH 7.5-8.6
• Blind XXE with OOB data exfiltration: HIGH 7.5
• Authenticated XXE: MEDIUM 6.5

References

• [Sinks](references/sinks.md)
• [False Positive Indicators](references/false-positive-indicators.md)
• [PoC Skeleton](references/poc-skeleton.md)

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: ByamB4
• Source: ByamB4/find-cve-agent
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.