vulns.co
/
mcp by GKData.io

Back to Gadgets

XML external entity / DTD fetch

Upload, SOAP, SAML, OOXML, RSS, SVG, or XML-RPC that still resolves SYSTEM/PUBLIC identifiers. Prove the fetch with OAST. Do not point it at metadata or local files first.

Tags: xxe, ssrf, saml, xml

Typical severity: P2-P4

What it becomes

A parser that loads a DTD from a URL you control is at least SSRF. File read and billion-laughs are extra, not the first proof.

Where to look

  • SAML ACS
  • Office document preview
  • SOAP
  • SVG sanitizers
  • RSS importers
  • XML backups

Chains

  • SSRF: External DTD or entity URL is fetched by the server. Canary first.
  • Blind file read: Only after the canary, and only if policy allows a non-sensitive file you own or a harmless path the program lists.
  • DoS: Recursive entities. Out of scope on almost every program. Do not.

Notes

  • SAML is XXE wearing a suit. Test the ACS XML separately from the redirect_uri work.
  • Stop at the callback. Internal hosts and file:// are a second, leased step.

Back to Gadgets