Is XXE possible in a file upload with .docx files?

closed as too broad by S.L. Barth, Xiong Chiamiov, forest, Stephane, Steve Mar 9 '18 at 23:52

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


In an XXE attack, the attacker sends XML including an external entity referencing some secret file or resource on the server. For this to be useful to the attacker, the server needs to include the external entity, and then either (a) return potentially secret data in the response, or (b) have some kind of side effect. The point here is that for an XXE attack to work, there needs to be something parsing the XML. The vulnerability is in how that parser is configured to behave.

A .docx file does indeed contian lots of (zipped) XML. So what does this mean for the case of a file upload?

For the server, it depends on how it treat the file. If it doesn't unzip it and parse the XML, to the server your docx file is just an octet stream like any other. XXE will not have any impact on the server. On the other hand, if there is e.g. a poorly written sanitizing function of some sort that inspects the content of the file, it could be vulnerable.

For the user downloading the file, they are most likely to open it in Microsoft Word. So to succesfully attack the client you would need a vulnerability Microsoft Office. Who knows what is out there, but I think that it would be considered a pretty big deal if you could find one.

Not the answer you're looking for? Browse other questions tagged or ask your own question.