Xerox FreeFlow Core External XML Entity Injection Server Side Request Forgery Attempt (CVE-2025-8355)

Tim Peck@timpeck

•updated Nov 10, 2025•0•21

This rule detects an attempted Server-Side Request Forgery (SSRF) via External XML Entity (XXE) injection targeting Xerox FreeFlow Core. The detection is based on HTTP POST requests containing specific XML and entity declarations indicative of an XXE attack, followed by a SYSTEM entity referencing an HTTP URL, which is characteristic of an SSRF attempt.