Description

Detects XML External Entity (XXE) vulnerabilities in PHP applications where external entity expansion is enabled. When XML parsers are configured to process external entities without proper restrictions, attackers can exploit this to read sensitive files, cause denial of service, or execute server-side request forgery attacks.

Detection Strategy

• Identifies PHP XML parser function calls and configurations in source code

• Checks if XML parser options or settings enable external entity expansion through dangerous configuration values

• Verifies if the XML parser allows external entities through either member functions or symbol configurations

• Reports a vulnerability when both dangerous XML parser settings are present and external entity processing is enabled

Vulnerable code example

<?php
$xml = file_get_contents($_GET['file']);

// Vulnerable: LIBXML_NOENT allows external entity processing
$xml_doc = simplexml_load_string($xml, 'SimpleXMLElement', LIBXML_NOENT);

// Vulnerable: Enables entity substitution which can lead to XXE
$reader = new XMLReader();...

✅ Secure code example

<?php
// Validate and sanitize input file path
$file = filter_input(INPUT_GET, 'file', FILTER_SANITIZE_STRING);
if (!is_readable($file)) {
    die('Invalid file access');
}

$xml = file_get_contents($file);...