Xml External Entities in Restify with Mutual Tls

XML External Entity (XXE) injection is a web application security issue that occurs when an application processes XML input containing references to external entities. In Node.js applications using the Restify framework, enabling XML parsing without strict controls can allow an attacker to force the parser to read local files, cause server-side request forgery (SSRF), or engage in denial-of-service scenarios. When Mutual TLS (mTLS) is enforced, the presence of client certificates changes the threat surface in ways that can indirectly facilitate or obscure XXE exploitation.

With mTLS, the server validates client certificates before application logic runs. This can create a false sense of strong authentication, leading developers to assume that only trusted clients can reach XML-parsing endpoints. However, if an authorized client (presented with a valid certificate) submits a malicious XML payload to a Restify endpoint that parses XML without disabling external entity resolution, the XXE vulnerability remains exploitable. In other words, mTLS does not prevent XXE; it only controls who can attempt the attack. An attacker who compromises a legitimate client certificate can still leverage XXE via crafted XML data, and the server-side request may be attributed to the authenticated client rather than an anonymous source, complicating incident response.

Additionally, mTLS can influence SSRF risks tied to XXE. When XXE is chained with server-side requests (for example, to fetch internal resources), mTLS on outbound connections is uncommon. If the Restify server does not require client certificates for outbound HTTP calls, an attacker may use XXE to reach internal services that rely on mTLS from the server outward. This mismatch means the presence of mTLS on inbound traffic does not automatically protect against SSRF via XML external entities. Proper input validation and secure XML parser configuration remain essential regardless of mTLS deployment.

To detect such combinations, a scanner like middleBrick runs checks across authentication, input validation, and data exposure categories in parallel. It examines whether XML parsing options allow external entity resolution and whether mTLS is enforced, reporting findings with severity and remediation guidance. This helps teams understand that mTLS secures transport and identity but does not mitigate XML parsing risks.

Securing Restify with mTLS requires explicit configuration of the TLS server options and certificate validation, while also ensuring XML parsing does not introduce XXE. Below are concrete code examples that combine both concerns.

First, set up Restify with mTLS by providing the server’s certificate and key, and by specifying a trusted CA to validate client certificates. Use the requestCert and rejectUnauthorized options to enforce client certificate validation.

const restify = require('restify');
const fs = require('fs');

const server = restify.createServer({
  certificate: fs.readFileSync('/path/to/server-cert.pem'),
  key: fs.readFileSync('/path/to/server-key.pem'),
  ca: fs.readFileSync('/path/to/ca-bundle.pem'),
  requestCert: true,
  rejectUnauthorized: true
});

server.get('/api/resource', (req, res, next) => {
  res.send({ message: 'mTLS authenticated request' });
  return next();
});

server.listen(8080, () => {
  console.log('Server listening on port 8080');
});

This configuration ensures that only clients presenting certificates signed by the specified CA can establish TLS connections. Note that this does not alter how XML bodies are parsed.

Second, if your Restify service must accept XML, disable external entity processing to prevent XXE. Use a parser option that turns off DTD loading and external entity resolution. For example, with the xml2js parser, set explicit options to avoid loading external entities:

const xml2js = require('xml2js');

const parser = new xml2js.Parser({
  explicitArray: false,
  ignoreAttrs: false,
  trim: true,
  // Ensure no external DTD or entity resolution
  processEntities: false,
  tagNameProcessors: [xml2js.processors.normalize]
});

server.post('/api/xml', (req, res, next) => {
  if (!req.is('application/xml') && !req.is('text/xml')) {
    return res.send(400, { error: 'Unsupported media type' });
  }
  parser.parseString(req.rawBody, (err, result) => {
    if (err) {
      return next(new restify.errors.BadRequestError('Invalid XML'));
    }
    res.send({ data: result });
    return next();
  });
});

Combining mTLS with secure XML parsing reduces the risk of both identity-based access issues and XML-based attacks. middleBrick’s scans can validate that mTLS settings are present and that XML parsers are configured to reject external entities, providing prioritized findings and remediation steps.

Finally, consider runtime protections such as limiting request body size and monitoring for unexpected entity expansion. These practices complement mTLS and secure XML handling, ensuring that authenticated sessions do not become a vector for XML-based attacks.