xslt-injection

XSLT injection testing identifies vulnerabilities where attacker-controlled XSLT stylesheets are executed server-side. It targets XML transform endpoints, SOAP services, and report generators that process user-supplied input to confirm data exfiltration, SSRF, and remote code execution flaws.

XSLT injection enables SSRF and remote code execution when attacker-controlled stylesheets are processed server-side. Exploitation uses DTD entities for XXE, the document() function for file reads, and platform-specific execution paths across Java, .NET, and PHP XSLT processors.

Processor fingerprinting automatically identifies the underlying XSLT engine, such as Xalan, Saxon, libxslt, or MSXML. Recognizing the specific processor allows security testers to select the correct exploitation path for the target environment.

XSLT injection testing supports multi-vector exploitation across Java, .NET, PHP, and libxslt ecosystems. It applies processor-specific techniques to verify vulnerabilities in web applications regardless of the underlying XSLT implementation.

The best way to detect XSLT injection out-of-band is by integrating standard security testing tools with the testing workflow. This approach confirms vulnerabilities by monitoring external interactions triggered by processor-specific payloads.

You should test SOAP services and XML report generators for XSLT injection when they accept user-supplied XML or stylesheets. These transform endpoints are highly susceptible to server-side execution of malicious stylesheets leading to data leaks.