Lab: Exploiting XXE using external entities to retrieve files
Summary: PortSwigger's Web Security Academy lab targets a "Check stock" feature that parses XML input and reflects unexpected values in its response. The solution defines an external entity pointing to file:///etc/passwd between the XML declaration and the stockCheck element, then replaces the productId number with a reference to that entity, and the response returns "Invalid product ID:" followed by the file's contents.
Bottom line: A single XML field that echoes back what it parses is enough to read /etc/passwd off the server, so any endpoint accepting XML - stock checks, uploads, modified content types - is a candidate for the same file disclosure.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026