I had come across an XML request-response pair while testing a web application and attempted to inject XXE payloads. Note that in this case no XML parameter sent in the request was getting reflected in the response. However as the request and response were in XML I decided to try XXE payloads.
Though I was not able to include any local file from the server in the response, I received different HTTP responses for request containing valid and invalid file names. e.g.
<!ENTITY file SYSTEM "file:///etc/hosts" (valid file) <!ENTITY file SYSTEM "file:///etc/hosts1" (invalid file)
For each of the above cases different HTTP responses were received. The valid file name returned an XML response without any errors and the invalid file name returned an XML parsing error clearly stating - 'file not found'.
I am finished with my report for the activity and have reported this issue as "File name enumeration due to XML parsing errors". However I was curious about different ways in which this vulnerability can be exploited to obtain more information about the back end server and would like to receive any inputs to assess the technical impact of this vulnerability.