File Upload XXE to Initial Access

What this lab covers

You find a file upload that processes XML, use external entity injection to read files the application never intended to expose, and follow the credentials you recover into the AWS environment behind it.

The serverless angle is what makes this current. A Lambda function's credentials are available from its environment, so a read primitive inside the function is enough, and there is no host to compromise.

It assumes no prior AWS experience and suits web testers moving into cloud work.

How XXE works and why it reaches credentials

The XML specification allows documents to define entities, including external ones that reference a URI. A parser configured to resolve them will fetch that URI and include the content, which means a document can instruct the parser to read a local file or make a network request.

Applications are exposed wherever XML is parsed, which is broader than most people assume. Document formats, configuration uploads, SOAP endpoints, SVG images and office file formats all involve XML, so the attack surface is not limited to obvious XML APIs.

In a serverless context the payoff differs. Rather than reading system files, the useful targets are the environment and the credentials available to the function, since a Lambda function receives credentials for its execution role through its environment, and a read primitive within the function is enough to obtain them.

How to detect this in your own environment

Look for outbound requests from parsing components. External entity resolution frequently causes the application to make a network request, and an XML parser initiating outbound connections is anomalous and is one of the clearer signals available.

Log and inspect uploaded document structure where feasible. Entity declarations in uploaded files have essentially no legitimate use in most applications.

On the cloud side, function execution role credentials used from outside the function environment is theft, and it is a reliable signal regardless of how the credentials were obtained.

How to prevent it

Disable external entity resolution and DTD processing in the parser. This is a configuration change in every mainstream XML library, it is the actual fix, and it costs nothing in almost all applications.

Prefer formats and parsers without this capability where you have the choice, and validate uploads by structure rather than by extension.

Scope the function execution role narrowly, since it defines what any flaw in the function is worth. A function that reads one table should have permission to read one table.

Real-world context

XXE appeared in the OWASP Top 10 and remains a recurring finding, particularly in applications that accept document uploads. Many parsers changed their defaults over time, and older libraries and configurations persist.

The serverless variation is worth understanding because it inverts an assumption. Teams often reason that a function is disposable and short-lived so compromise matters less, when in fact the credentials it holds are exactly what an attacker wants and are available immediately.

The pattern maps to MITRE ATT&CK T1190 Exploit Public-Facing Application, T1083 File and Directory Discovery and T1552 Unsecured Credentials.

Applying this at work

• Audit every place your applications parse XML, including document, image and office formats, and confirm external entity resolution is disabled.
• Check your XML library versions and defaults, since older configurations may resolve entities without any explicit setting.
• Review Lambda execution role permissions and reduce them to the specific resources each function needs.
• Add detection for outbound network requests originating from parsing components.
• Confirm you would notice function credentials being used from outside your environment.

Frequently asked questions

What is XXE and why does it happen?

XML external entity injection occurs when a parser resolves external entities defined in a document, allowing it to read local files or make network requests. It is usually a parser configuration issue rather than unsafe application code.

Where can XXE appear besides obvious XML endpoints?

Anywhere XML is parsed, including SVG images, office document formats, configuration uploads and SOAP services. The attack surface is much broader than endpoints explicitly labeled as XML.

Why are Lambda credentials a target?

Because the function receives credentials for its execution role through its environment. A read primitive inside the function is sufficient to obtain them, and no host compromise is required.

Do I need my own AWS account to practice this?

No. The lab runs in a live AWS environment that Pwned Labs provisions for you, so there is nothing to set up and no risk to your own infrastructure.

Which certification covers this in depth?

The Amazon Cloud Red Team Professional (ACRTP) covers AWS attack and detection paths in full, including IAM abuse and privilege escalation, and is assessed hands-on in a live AWS account.