XXE

securityweb dev

Stands for: XML External Entity

An attack that abuses XML external entities to read files or reach internal systems.

XML External Entity injection tricks an XML parser into resolving an external entity, letting an attacker read local files, reach internal services (SSRF), or cause denial of service. The fix is to disable DOCTYPE/external-entity processing in the parser.

XXE abuses a feature XML has that almost nobody wants: the ability for a document to declare an entity whose content is fetched from somewhere else. A parser that resolves those entities will happily read a local file or make a network request because the document asked it to, and return the result inside the parsed output.

The consequences depend on where the parser sits. Reading local files is the classic demonstration, but the network request is often worse, because it turns the parser into a server-side request forgery primitive with access to internal addresses and cloud metadata endpoints. Blind variants exfiltrate data through out-of-band channels even when the response body never shows the result, which makes the vulnerability invisible in ordinary testing.

The fix is unusually clean for a web vulnerability class. Disable external entity resolution and document type declarations entirely in the parser configuration, because virtually no legitimate application needs them, and modern parsers increasingly default to safe behaviour. The remaining risk is old libraries, inherited code, and file formats that are XML underneath without anyone thinking of them that way, which is how office documents and image metadata keep producing new instances of a supposedly solved problem.

Also known as: xxe

← All glossary entries