Xml External Entities in Aspnet with Bearer Tokens

An XML External Entity (XXE) vulnerability occurs when an application processes XML input that references external entities, and the server-side XML parser is configured to resolve them. In ASP.NET, this typically involves insecure uses of XmlDocument, XmlReader, or third-party XML libraries that do not disable DTD processing and external entity resolution. When an API endpoint accepts XML payloads and also validates access using bearer tokens, the combination can expose sensitive behaviors and data even when authentication appears intact.

Bearer tokens are often transmitted in the Authorization header as Bearer <token>. If the endpoint processes XML input that triggers external entity resolution, an attacker can leverage XXE to interact with internal resources accessible to the server. For example, an attacker might craft an XML body that references a local file or an internal service endpoint, and the server’s XML parser follows the reference. Because the request includes a valid bearer token, the server may process the request with the permissions associated with that token, potentially allowing exfiltration of files or interaction with internal services that would otherwise be restricted.

Consider an ASP.NET endpoint that accepts XML to configure or import data. If the XML parser does not prohibit external entities, an attacker can supply a payload like the following, aiming to read a file that may be referenced indirectly via the bearer token–protected context:

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [ <!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>>
<root>&xxe;</root>

If the server resolves the external entity, the contents of /etc/passwd can be returned in error messages or logs. Because the request carried a bearer token, the operation may be logged as authenticated, making it harder to distinguish malicious activity from legitimate use. In some configurations, the XML parser may also follow network-based external entities, enabling Server-Side Request Forgery (SSRF) against internal services that expect the bearer token in headers. This increases the potential impact by allowing the attacker to reach internal endpoints that are not exposed publicly but are accessible from the server.

ASP.NET applications that use XmlDocument without secure settings are particularly at risk. By default, XmlDocument resolves external entities if DTD processing is enabled. Even when using XmlReader, failing to set XmlReaderSettings to prohibit DTDs and external references leaves the parser open to XXE. The presence of a bearer token does not mitigate these parser-level misconfigurations; it only ensures that the request is treated as authenticated, which may broaden the scope of what the attacker can observe or trigger.

To illustrate the risk in the context of compliance frameworks, an application processing XML with bearer tokens might violate OWASP API Security Top 10 items related to broken object level authorization and excessive data exposure, especially if XXE leads to unintended data access. Regular security scans that include unauthenticated attack surface testing can surface these weaknesses even when bearer tokens are present, highlighting the need to disable DTD and external entity resolution regardless of authentication mechanisms.

Securing ASP.NET APIs that accept bearer tokens and XML input requires disabling DTD and external entity resolution in all XML parsers. Below are concrete code examples that demonstrate secure configurations for common XML APIs used in ASP.NET.

Secure XmlDocument usage. Do not use XmlDocument for untrusted XML; prefer XmlDocument with a custom XmlReader that disables DTDs, or migrate to safer APIs. If you must use XmlDocument, configure the resolver to null and avoid loading external DTDs:

using System.Xml;
using System.Xml.Schema;

public static XmlDocument CreateSecureXmlDocument()
{
    var settings = new XmlReaderSettings
    {
        DtdProcessing = DtdProcessing.Prohibit,
        XmlResolver = null
    };
    var document = new XmlDocument();
    using (var reader = XmlReader.Create(new System.IO.StringReader(""), settings))
    {
        // Load XML via secure reader if needed; for direct loading use Parse with caution
        document.LoadXml(""); // Provide your XML string here
    }
    return document;
}

Secure XmlReader usage. Always set XmlReaderSettings to prohibit DTDs and disable the resolver. This prevents external entity expansion regardless of bearer token presence:

using System.Xml;

var readerSettings = new XmlReaderSettings
{
    DtdProcessing = DtdProcessing.Prohibit,
    XmlResolver = null
};

using (var reader = XmlReader.Create("input.xml", readerSettings))
{
    while (reader.Read())
    {
        // Process nodes safely
    }
}

Using XmlDocument with secure settings via Load. If you load from a stream or file, apply the same settings via an created with secure settings:

using System.Xml;
using System.IO;

var settings = new XmlReaderSettings
{
    DtdProcessing = DtdProcessing.Prohibit,
    XmlResolver = null
};

using (var stream = File.OpenRead("data.xml"))
using (var reader = XmlReader.Create(stream, settings))
{
    var doc = new XmlDocument();
    doc.Load(reader);
    // Use doc safely
}

Minimal API endpoint example with bearer token and secure XML parsing. This shows how to combine authentication checks with secure parsing in an endpoint. Note that bearer token validation is handled separately (e.g., via authentication middleware), and the XML parsing explicitly prohibits external entities:

using Microsoft.AspNetCore.Mvc;
using System.Xml;

[ApiController]
[Route("api/import")]
public class ImportController : ControllerBase
{
    [Post]
    public IActionResult Import([FromBody] string xmlBody)
    {
        // Bearer token validation is enforced by ASP.NET authentication pipeline
        // Example: [Authorize]

        var settings = new XmlReaderSettings
        {
            DtdProcessing = DtdProcessing.Prohibit,
            XmlResolver = null
        };

        try
        {
            using var reader = XmlReader.Create(new System.IO.StringReader(xmlBody), settings);
            var doc = XDocument.Load(reader);
            // Process doc safely
            return Ok(new { message = "Processed securely" });
        }
        catch (XmlException)
        {
            return BadRequest(new { error = "Invalid XML" });
        }
    }
}

These configurations ensure that even if a request includes a bearer token and valid authentication, XML processing will not resolve external entities. Always prefer secure defaults and avoid enabling DTD processing or external entity resolution in any XML parser used by your ASP.NET APIs.