Skip to content
attack.paths
Connexion
← RegistryDossier · 6 steps · 5 edges

XXE → SSRF → IMDS → cloud creds

XML parser configured with external entities resolution. Use XXE to make the server hit IMDS and exfiltrate cloud credentials via DTD trickery.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: an endpoint accepts XML input (SAML, SOAP, document upload, RSS importer). XML parser doesn't disable DOCTYPE / external entities.

§ Steps

  1. 01
    Move laterally via cloud APIsInitial Access
    T1078— Valid Accounts
  2. 02
    Recover IAM credentialsCredential Access
    T1552— Unsecured Credentials
  3. 03
    Find XML-accepting endpointReconnaissance
    W-RECON-API-DISCO— API Endpoint Discovery
  4. 04
    Read IMDS via parameter entity exfilLateral Movement
    W-SSRF-IMDS— SSRF → Cloud IMDS
  5. 05
    Confirm XXE via OOB callbackLateral Movement
    W-XXE-BLIND-OOB— Blind XXE — Out-of-Band Exfil
  6. 06
    XXE → SSRF (SYSTEM "http://169.254.169.254")Lateral Movement
    W-XXE-SSRF— XXE → SSRF

§ References

§ Frequently asked

What is the "XXE → SSRF → IMDS → cloud creds" attack path?
XML parser configured with external entities resolution. Use XXE to make the server hit IMDS and exfiltrate cloud credentials via DTD trickery. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Move laterally via cloud APIs (T1078) — a initial access primitive. Assumed environment: an endpoint accepts XML input (SAML, SOAP, document upload, RSS importer).
What is the final impact of this kill-chain?
The final step lands on XXE → SSRF (SYSTEM "http://169.254.169.254") (W-XXE-SSRF), which falls under Lateral Movement. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers