php-xxe-audit

PHP XXE Audit (php-xxe-audit)

Analyze PHP project source code to identify XXE (XML External Entity) risks: when an XML parsing point allows external entities/DOCTYPE, and the XML input is controllable, and an echo or OOB channel exists, it may lead to file read/SSRF/DoS.

Grading and Numbering

• See details:shared/SEVERITY_RATING.md
• Vulnerability ID:{C/H/M/L}-XXE-{序号}

XXE Sink (Required)

Identify XML parsing related:

• DOMDocument->loadXML/loadHTML
• simplexml_load_string/simplexml_load_file
• XMLReader->open/xml
• DOMDocument->load(if the content comes from a user-controllable string/stream) Dangerous patterns:
• External entities not disabled/network access not restricted
• Parsing parameters allow DOCTYPE

Protection Check (Required)

Must output parser protection evidence:

• libxml security parameters:LIBXML_NONET、LIBXML_NOENT(Note: NOENT may amplify risk),LIBXML_DTDLOAD usage, etc.
• Whether used:libxml_disable_entity_loader(true)(different PHP versions have different policies, evidence is still required)
• Whether security options are passed in during parsing and network access is disabled

Input Sources and Echo (Required)

Must output separately:

• XML input sources:$_POST/php://input/uploaded file streams, etc.
• Echo path: whether the parsing result is written back to the response (echo/template output) or only Blind (OOB).

tracer Trigger Conditions (Required)

• Fields are output again after XML has passed through multiple layers of transfer/parsing
• The echo location is unclear or is in a utility class

Evidence Citation (Mandatory: from php-route-tracer)

Each suspected XXE vulnerability must cite, item by item, from the trace output the ## 9) Sink Evidence Type Checklist of the XXE linescorresponding evidence points (status may be pending verification, but evidence citations must exist):

1. EVID_XXE_PARSER_CALL: Evidence of the location of the XML parser call point (DOMDocument->loadXML/simplexml_load_string/XMLReader->open, etc.)
2. EVID_XXE_INPUT_SOURCE: Evidence of the input stream source ($_POST/php://input/upload read/corresponding evidence of parameters entering parsing)
3. EVID_XXE_ENTITY_DOCTYPE_SAFETY_AND_ECHO: Evidence of security options related to disabling external entities/DOCTYPE (LIBXML_* or disabling policies), as well as evidence of the echo location of the parsing result

Handling Missing tracer Evidence (Mandatory)

• If any of the above key evidence points 1~3 cannot be located: the vulnerability status can only be marked as ⚠️待验证, and ✅已确认可利用。

Report Output

Output to:

{output_path}/vuln_audit/xxe_{timestamp}.md