XML External Entity (XXE) Injection in Symfony

Use this free tool to scan for Website Security checks and find common web vulnerabilities like XXE Injection, SQLi, XSS, and more. Our scans generate a full vulnerability assessment report in seconds.

What is XML External Entity (XXE) Injection?

XXE Injection occurs when a web application parses XML input using a vulnerable XML parser and external entities are enabled. Symfony applications are at risk if untrusted XML input is processed without disabling external entity resolution.

🛑 Dangers of XXE:

• Reading sensitive files like /etc/passwd

• Server-Side Request Forgery (SSRF)

• Denial of Service (DoS) via Billion Laughs attack

• Data exfiltration to remote systems
  
  

⚙️ Exploiting XXE in Symfony: Real-World Example

Here’s a basic XML payload that exploits an XXE vulnerability:

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE foo [

  <!ELEMENT foo ANY >

  <!ENTITY xxe SYSTEM "file:///etc/passwd" >

]>

<foo>&xxe;</foo>

If the Symfony backend is parsing this XML using a vulnerable configuration, it will respond with the contents of /etc/passwd.

Sample Symfony Code Vulnerable to XXE:

use Symfony\Component\HttpFoundation\Request;

public function uploadXml(Request $request)

{

    $xmlContent = $request->getContent();

    $xml = simplexml_load_string($xmlContent); // ⚠️ Vulnerable

    // Process XML...

}

This code processes untrusted XML input without disabling external entity loading.

🛡️ How to Prevent XXE in Symfony

To secure Symfony from XXE, you must disable external entity loading before parsing XML.

✅ Secure Example Using DOMDocument:

use Symfony\Component\HttpFoundation\Request;

public function secureXmlUpload(Request $request)

{

    $xmlContent = $request->getContent();

    $dom = new \DOMDocument();

    $dom->resolveExternals = false;

    $dom->substituteEntities = false;

    libxml_disable_entity_loader(true);

    libxml_use_internal_errors(true);

    $dom->loadXML($xmlContent, LIBXML_NOENT | LIBXML_DTDLOAD); // Use caution

    libxml_clear_errors();

    // Process safe XML...

}

✅ Secure Example Using Symfony Serializer:

If you're using Symfony's Serializer with XML encoders, ensure to disable external entity loading:

use Symfony\Component\Serializer\Encoder\XmlEncoder;

$xmlEncoder = new XmlEncoder([

    'load_external_entities' => false, 

    'disable_entities' => true

]);

🧪 Scan Your Symfony Site for XXE with Our Free Tool

To test your website securely, use our Free Website Security Scanner. It scans for XXE and other critical vulnerabilities in real-time.

📸 Screenshot of a Vulnerability Report from Our Tool