Ktor versions older than 2.3.5

Reproduction environment

This is my setup for reproducing the issue:

• IntelliJ IDEA 2025.2.4
• Ktor 2.3.4
• JDK 21
• OS: Windows 10

XXE explained

XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. The XML parser can access the contents of this URI and embed these contents back into the XML document for further processing. By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file.
For example, a URI such as "file:///c:/winnt/win.ini" designates (in Windows) the file C:\Winnt\win.ini, or file:///etc/passwd designates the password file in Unix-based systems.
(https://cwe.mitre.org/data/definitions/611.html)

How it works

A POST request is made to the endpoint http://localhost:8080/xml.
The request sends an xml file, exploit/payloads/xxe-demo-file.xml, containing a <!DOCTYPE> element in which an external entity is referenced, exploit/etc/secret.txt in this case.

This could potentially be any other file on the system to which the process has acces to.

xxe-demo-file.xml

The XML parser (configured to allow DTDs) resolves this element and retrieves the resource data.

The external reference could also be a path to an SSRF endpoint, or could point to a large file in order to occupy system's resources (DOS).

Reproduction steps

1. Run the server:

2. Output should be:

3. Send the XXE payload using curl:

Expected result (vulnerable):

Console outputs: Received: <external entity data>

Expected result (secure):

400 Bad Request, or similar (The XML parser blocks Document Type Definition)

Evidence

Run command:

Send XXE payload using cURL, and the result displaying injected file contents:

Severity

Severity is high/critical. Potential local file retrieval, SSRF attack, DoS attack, or other system impacts.
NVD Base Score: 9.8 CRITICAL (CVSS v3) (https://nvd.nist.gov/vuln/detail/CVE-2023-45612)

Prevention guidelines draft for developers

• Configure the XML parser to not resolve external entities. If external entities are needed, implement a custom XmlResolver with a request timeout, data retrieval limit, and restrict resources it can retrieve locally.
• Use resources like the OWASP XXE Prevention cheat sheet, which covers XXE prevention implementation, specifically for various technologies.
• Integrate SAST into CI, since it can find some instances of this weakness by analyzing source code.
• Track and analyze dependency versions and vulnerabilities.
• Implement secure coding standards at company level.
• Emphasize the integration of security throughout the SDLC, especially in the design and developer testing phases.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-45612
• https://cwe.mitre.org/data/definitions/611.html
• https://capec.mitre.org/data/definitions/221.html
• https://medium.com/@iason.tzortzis/xxe-xml-external-entity-injection-explained-e8be5f1f7cd7
• https://ktor.io/docs/server-create-a-new-project.html#create-project-with-the-ktor-project-generator
• https://www.jetbrains.com/privacy-security/issues-fixed/?product=Ktor
• https://ktor.io/docs/2.3.13/welcome.html
• https://portswigger.net/web-security/xxe#exploiting-xxe-to-retrieve-files
• https://ssojet.com/parse-and-generate-formats/parse-and-generate-xml-in-ktor/
• https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
• https://owasp.org/Top10/A05_2021-Security_Misconfiguration/