Easy
InvoicePilot XML import file read
A freelance invoicing tool. Uploaded invoice XML is parsed with external entity loading left on.
0 solves
XXE
An XML parser that resolves external entities lets a document read files or reach internal services on the server's behalf.
What it is
XML External Entity (XXE) injection happens when an XML parser is configured to resolve external entities defined inside a document, letting an attacker read local files, reach internal services, or in some configurations cause denial of service, through a document the application never intended to trust that much.
How it works
$xml = simplexml_load_string($_POST['invoice_xml']);
<?xml version="1.0"?> <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> <invoice><total>&xxe;</total></invoice>
If the parser resolves external entities, &xxe; is replaced with the
target file's content before the application ever sees the parsed data.
Real-world impact
Local file disclosure (configuration files, source code, credentials), server-side request forgery through the same entity mechanism, and denial of service through entity expansion.
How to prevent it
libxml_disable_entity_loader(true); // PHP < 8: confirm it's actually off
Disable external entity resolution explicitly, don't assume a library's default is safe without checking the installed version, and avoid allowing a DTD at all in untrusted XML wherever the format permits it.
Labs in this topic
Medium
FlightLog GPX out-of-band XXE
A pilot logbook. Parsed content is never reflected back, but the parser still resolves external entities.
0 solves