# XXE via File upload

Some application allow users to upload files which are processed server side Some common file formats use `XML` or contain `XML subcomponents`.

Examples of XML based formats are office document formats like `.docx` and image formats like `.svg`.

* If an application allows users to upload images and process or validate these on the server after they are uploaded
* If the application expects to receive a format like `.png` or `.jpeg`, then the image processing lib is likely to accept `.svg` too

Since the SVG format uses XML, an attacker can submit a malicious SVG image and so reach hidden attack surface for XXE vulnerabilities.

![](https://i.imgur.com/foYZV5u.jpg)

> First check, the client/server validation by uploading a normal .png or .jpeg file

Usually returns an error saying, the `avatar is too large`.

> Now intercept that request and try changing the png fromat to an XML svg format

```
<?xml version="1.0" standalone="yes"?><!DOCTYPE test [ <!ENTITY [xxe](https://portswigger.net/web-security/xxe) SYSTEM "file:///etc/hostname" > ]><svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1"><text font-size="16" x="0" y="16">&xxe;</text></svg>
```

The above payload returns us the `hostname`, using the XInclude namespace reference.

> The application verifies the above payload as a SVG image and then gives us a 200

### XXE via Modified Content-Type

Most of the POST requests have a default `Content-Type` that is generated by HTML forms, such as

* application/x-www-form-urlencoded

So here an Attacker can tamper, the Content-Type to an XML format.

```
POST /action HTTP/1.0 
Content-Type: text/xml 
Content-Length: 52 
<?xml version="1.0" encoding="UTF-8"?><foo>bar</foo>
```

If the application allows the content-type which is configured by the server's backend MIME type then an attacker can :

* Find the hidden XXE attack surface simply by reformatting requests to use the XML format
