> For the complete documentation index, see [llms.txt](https://sayonara.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sayonara.gitbook.io/writeups/portswigger/xxe-xml-external-entities/exploiting-xxe-via-image-file-upload.md).

# Exploiting XXE via image file upload

<div align="left"><figure><img src="/files/K9bPonTm4BIEKFPzQlSB" alt=""><figcaption></figcaption></figure></div>

after mapping the website we find a file upload in the post comment functionnality

<div align="left"><figure><img src="/files/X8etJlerf6pRCZoJcqQl" alt=""><figcaption></figcaption></figure></div>

this application allows users to **upload images**, and process or validate these on the server after they are uploaded. Even if the application expects to receive a format like PNG or JPEG, the **image processing library that is being used might support SVG images**. Since the SVG format uses XML, we can submit a malicious SVG image and so reach hidden attack surface for XXE vulnerabilities.

let's create an svg image that contains XML payload to retrieve the /etc/hostname file from the application's server

```markup
<?xml version="1.0" standalone="yes"?><!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/hostname" > ]><svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1"><text font-size="16" x="0" y="16">&xxe;</text></svg>
```

now let's upload this file

<div align="left"><figure><img src="/files/TrtGMrZmcC2ZpXgdPbLN" alt=""><figcaption></figcaption></figure></div>

after clicking on post comment

<div align="left"><figure><img src="/files/5h1LGl1pi4YpzJ56OZFu" alt=""><figcaption></figcaption></figure></div>

click on back to blog to see the svg image we have uploaded in the comment section

<div align="left"><figure><img src="/files/SJfIiAXJ1RPyyv2B1V0m" alt=""><figcaption></figcaption></figure></div>

right click on this svg image and click on `open in new tab`&#x20;

<div align="left"><figure><img src="/files/MZCGYzuANFYVqSevgD9f" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/heXxJzAtDS5QkVGMrgg8" alt=""><figcaption></figcaption></figure></div>

submit the server hostname data and we have solved the lab

<div align="left"><figure><img src="/files/stFEFyslKc7wTReBI6WM" alt=""><figcaption></figcaption></figure></div>

hope you found this walkthrough easy to understand and follow

Greeting From [<mark style="color:red;">**Sayonara**</mark>](https://github.com/ismail-arame)