Diagnosing and Mitigating XXE in Java XML Parsers

Recognizable condition

When an application processes user‑supplied XML and returns unexpected internal file contents, stack traces that reference local paths, or error messages that reveal internal resources, it may be vulnerable to XML External Entity (XXE) injection.

Cause / diagnostic table

Condition	Underlying cause	Typical symptom
Parser processes a DOCTYPE declaration	External entity defined in the DTD is resolved	Response includes contents of a file specified in SYSTEM URI or triggers an out‑of‑band request
Application returns detailed XML parsing errors	Error messages expose system paths or internal DTD details	Stack trace shows java.io.FileNotFoundException for file:///…

Ordered checks

1. Verify parser feature settings

   Locate where the XML factory is created (e.g., DocumentBuilderFactory, SAXParserFactory, XMLInputFactory). Ensure the following features are set to true before parsing:

   • http://apache.org/xml/features/disallow-doctype-decl
   • http://apache.org/xml/features/nonvalidating/load-external-dtd (set to false)
   • http://xml.org/sax/features/external-general-entities (set to false)
   • http://xml.org/sax/features/external-parameter-entities (set to false)

   Example (Java, requires read access to the source code):

   DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
   dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
   dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
   dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
   dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
   

   Run the application in a test environment and confirm no exception is thrown when parsing a benign XML document.

2. Inspect code for missing feature calls

   Search for factory instantiations that lack the above setFeature calls. Use your IDE’s search for "DocumentBuilderFactory.newInstance()" or "SAXParserFactory.newInstance()".

3. Perform a controlled XXE test

   Deploy a test XML payload that references a file you control (e.g., test.txt in the application’s working directory). Do not point to sensitive system files.

   <!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///app/test.txt"> ]>
   &xxe;
   

   If the parsed output contains the contents of test.txt, the parser is still resolving external entities.

   Required permissions: the process must be able to read the test file; run the test as a low‑privilege service account.

   Risk: the test may cause unintended file reads if the payload is mis‑directed; limit the test to a staging environment.

Fixes tied to findings

• Disable DTD and external entity processing – Apply the feature settings shown in Check 1. This is the most direct mitigation.
• Use parser versions with safe defaults – JDK 9 and later ship with disallow-doctype-decl enabled by default for the built‑in parsers. If you remain on JDK 8, explicitly set the features or upgrade.
• Prefer StAX with DTD support turned off – When using XMLInputFactory, set:

XMLInputFactory factory = XMLInputFactory.newInstance();
factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);

• Apply input validation – Reject XML containing a DOCTYPE declaration or limit the size of incoming XML to reduce attack surface.
• Deploy a WAF rule – As a temporary measure, block requests that contain the string <!DOCTYPE or SYSTEM in the XML body.

Escalation criteria

• If the controlled XXE test succeeds in a staging or production environment, treat the finding as high severity.
• When the application processes XML from untrusted external partners (e.g., API integrations) and the parser cannot be reconfigured due to legacy dependencies, prioritize immediate patching or compensating controls.
• If error messages reveal internal file paths, consider the vulnerability critical and initiate an incident‑response process.

Limitations and practical verification

Disabling DTD processing may break legitimate XML that relies on internal entity references or internal DTDs for default values. Before applying changes, run your existing test suite against a representative set of valid XML documents to ensure no functional regression.

To verify that the mitigation is effective:

1. Enable debug logging for the XML factory (many implementations log feature values when setFeature is called).
2. Confirm that the logged values for disallow-doctype-decl and related features are true (or false for the load‑external‑DTD feature).
3. Run the controlled XXE test again; the parser should throw an exception such as org.xml.sax.SAXParseException: DOCTYPE is disallowed when the feature "http://apache.org/xml/features/disallow-doctype-decl" set to true and must not return the contents of the test file.

Document the version of the XML library you are using (e.g., Xerces 2.12.0, Woodstox 6.4.0) and consult its release notes to verify whether the default behavior changed in newer releases.