XML external entity / DTD fetch
Upload, SOAP, SAML, OOXML, RSS, SVG, or XML-RPC that still resolves SYSTEM/PUBLIC identifiers. Prove the fetch with OAST. Do not point it at metadata or local files first.
Tags: xxe, ssrf, saml, xml
Typical severity: P2-P4
What it becomes
A parser that loads a DTD from a URL you control is at least SSRF. File read and billion-laughs are extra, not the first proof.
Where to look
SAML ACSOffice document previewSOAPSVG sanitizersRSS importersXML backups
Chains
- SSRF: External DTD or entity URL is fetched by the server. Canary first.
- Blind file read: Only after the canary, and only if policy allows a non-sensitive file you own or a harmless path the program lists.
- DoS: Recursive entities. Out of scope on almost every program. Do not.
Notes
- SAML is XXE wearing a suit. Test the ACS XML separately from the redirect_uri work.
- Stop at the callback. Internal hosts and file:// are a second, leased step.