An entity that reaches the network

Labs need a computer

Open this page on a computer, or make the browser window larger.

Loading the lab.

Scenario

The Hacker now blocks file:// reads in the XML parser, but external entities still work over http, turning XXE into a way to reach internal services, including the cloud metadata service at 169.254.169.254.

What you are looking at

The same feed import, but file reads are now blocked. The external entity still accepts http URLs, so XXE becomes a way to make the server fetch internal addresses like the cloud metadata service.

Goal

Use an external XML entity over http to reach the cloud metadata service and steal the access keys.

What counts as solved

You turned XXE into SSRF, reached the cloud metadata service, and stole the keys.

Method checklist

Tick each step as you work through it. The steps are the method, not the answer.

Try an entity that reads a file and note it is blocked.
Recall the entity also accepts http URLs.
Point the entity at the cloud metadata address.
Read the credentials that came back.

Hints

You have not revealed a hint yet. Ask the falcon when you need one.

Why the solution worked

Even with file reads blocked, an external entity still reaches the network over http, turning XXE into an SSRF path to internal services and the cloud metadata. The fix: disable external entities and DTDs entirely — do not block one protocol — and isolate the service at the network level and block the metadata service.

The root cause

Blocking the file scheme is not enough while http is allowed: the external entity makes the server send a request, turning XXE into SSRF. The root is leaving external entities enabled.

How the code is fixed

Blocking one protocol is not enough; disable entities entirely. XXE reaches both files and the network.

Vulnerable code

blockFileProtocol(parser); // only file:// blocked; http:// entities still resolve

Safe code

const parser = new XMLParser({ resolveExternalEntities: false, processEntities: false });
parser.parse(xml); // no external entity resolves at all, file or http

Impact in the real world

XXE-to-SSRF reaches internal services and the cloud metadata service and leaks credentials, a known real-world breach path.

How defenders detect it

Defenders disable external entities entirely, block the parser from any network request, and alert on outbound requests toward internal ranges.

Back to the lesson