# XXE via external entity resolution

Untrusted XML/SVG/SAML parsed with entities, DTDs or XInclude enabled, reaching files, SSRF or metadata

_Area: Web injection and code execution. Seen in 10 disclosed reports; 4 confirmed bounties, median $1,750, range $100-$9,000; latest 2025-02-12. Updated 2026-10-23._

## How it works
An XML parser is handed a document that references external entities or XIncludes. The parser treats the reference as trusted and resolves it: a local file, an internal URL, or a remote DTD. The assumption that breaks is that user-supplied XML is inert data. Once entity substitution is on, the document controls what the server reads and where it connects, and the fetched content can be reflected back or sent out-of-band.

## Where it shows up
- Parsers configured with entity substitution or DTD loading: `LIBXML_NOENT`, external DTD resolution, XInclude processing [E1](https://bugbountylibrary.com/r/h1%3A347139.md)[E4](https://bugbountylibrary.com/r/blog%3Ablog-sonarsource-com-wordpress-xxe-security-vulnerability.md)[E5](https://bugbountylibrary.com/r/blog%3Aalmadj-us-infosec-xxe-to-aws-metadata-disclosure.md).
- SVG-to-raster converters (ImageMagick and similar) that honor external entities and XIncludes [E1](https://bugbountylibrary.com/r/h1%3A347139.md).
- XML fetched from a predictable cloud bucket or URL the attacker can register [E2](https://bugbountylibrary.com/r/h1%3A1216085.md).
- Framework deserializers that auto-instantiate nested types from JSON, reaching an XML sink [E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-why-nested-deserialization-is-harmful-magento-xxe-cve-2024-34102.md).
- SAML/SSO and legacy spell-check endpoints that decode and parse XML, especially unauthenticated ones [E6](https://bugbountylibrary.com/r/h1%3A715949.md).
- Media/metadata parsers (getID3 iXML) invoked on uploaded files [E4](https://bugbountylibrary.com/r/blog%3Ablog-sonarsource-com-wordpress-xxe-security-vulnerability.md).
- Crawlers/indexers that fetch and parse attacker-supplied sitemaps or feeds [E7](https://bugbountylibrary.com/r/h1%3A1156748.md).
- Upload endpoints whose extension allowlist is a client-supplied parameter, feeding a later XML parse [E8](https://bugbountylibrary.com/r/h1%3A500515.md).

## How to review
Find every place untrusted XML/SVG/SAML is parsed and check the parser configuration, not the input filter. The invariant: external entity and XInclude resolution must be disabled, and no user-controlled DTD may be fetched. Verify the guard actually runs on the deployed runtime (PHP 8 deprecation of `libxml_disable_entity_loader` silently skips it) [E4](https://bugbountylibrary.com/r/blog%3Ablog-sonarsource-com-wordpress-xxe-security-vulnerability.md). For converters, confirm the SVG is parsed with entities off and that scheme filters cannot be bypassed with protocol-relative `//` URLs [E1](https://bugbountylibrary.com/r/h1%3A347139.md). For SAML, trace the decode-then-parse path and confirm the entity resolver is off before any signature check [E6](https://bugbountylibrary.com/r/h1%3A715949.md). For JSON-to-object frameworks, enumerate which nested types can reach an XML sink [E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-why-nested-deserialization-is-harmful-magento-xxe-cve-2024-34102.md).

## Variants seen
- SVG conversion in an image editor yielding LFI and SSRF, filter bypassed via `//` [E1](https://bugbountylibrary.com/r/h1%3A347139.md).
- Attacker-registered S3 `files.xml` as the XML entry vector; a separate downstream SQLi was reached afterward [E2](https://bugbountylibrary.com/r/h1%3A1216085.md).
- Nested deserialization reaching `SimpleXMLElement` pre-auth [E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-why-nested-deserialization-is-harmful-magento-xxe-cve-2024-34102.md).
- Authenticated WAV/iXML upload with blind OOB file read [E4](https://bugbountylibrary.com/r/blog%3Ablog-sonarsource-com-wordpress-xxe-security-vulnerability.md).
- Login endpoint XXE where fetched content is reflected inline, then SSRF to AWS metadata [E5](https://bugbountylibrary.com/r/blog%3Aalmadj-us-infosec-xxe-to-aws-metadata-disclosure.md).
- Authenticated XXE in a legacy ASP.NET spell-check endpoint [E6](https://bugbountylibrary.com/r/h1%3A715949.md).
- Crawler sitemap parser reached via a robots.txt directive [E7](https://bugbountylibrary.com/r/h1%3A1156748.md).
- Client-controlled upload allowlist feeding an XML page service [E8](https://bugbountylibrary.com/r/h1%3A500515.md).

## Why fixes fail
Conditional guards tied to deprecated functions reopen XXE on newer runtimes while comments claim safety [E4](https://bugbountylibrary.com/r/blog%3Ablog-sonarsource-com-wordpress-xxe-security-vulnerability.md). Scheme regexes miss protocol-relative URLs [E1](https://bugbountylibrary.com/r/h1%3A347139.md).

## Impact and severity
File read (config, keys, logs), SSRF to internal services and cloud metadata with IAM credential theft, and pivots to separate bugs [E1](https://bugbountylibrary.com/r/h1%3A347139.md)[E2](https://bugbountylibrary.com/r/h1%3A1216085.md)[E5](https://bugbountylibrary.com/r/blog%3Aalmadj-us-infosec-xxe-to-aws-metadata-disclosure.md)[E6](https://bugbountylibrary.com/r/h1%3A715949.md). Severity rises with pre-auth reachability and when fetched content is reflected or exfiltrated out-of-band.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A347139.md
- E2: https://bugbountylibrary.com/r/h1%3A1216085.md
- E3: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-why-nested-deserialization-is-harmful-magento-xxe-cve-2024-34102.md
- E4: https://bugbountylibrary.com/r/blog%3Ablog-sonarsource-com-wordpress-xxe-security-vulnerability.md
- E5: https://bugbountylibrary.com/r/blog%3Aalmadj-us-infosec-xxe-to-aws-metadata-disclosure.md
- E6: https://bugbountylibrary.com/r/h1%3A715949.md
- E7: https://bugbountylibrary.com/r/h1%3A1156748.md
- E8: https://bugbountylibrary.com/r/h1%3A500515.md