XXE: XML external entities

In short: XXE (“XML external entity”) exploits that some XML parsers may reference external files or addresses in a document. A manipulated document can thus read server files.

In more detail: XML allows so-called entities in the DOCTYPE declaration that point to files (file://) or URLs. A parser with default settings loads them and inserts the content into the document.

In Depth

• Consequences: Reading local files, requests to internal services (SSRF), denial of service through huge nested entities (“Billion Laughs”).
• Where it occurs: Wherever XML is accepted: SOAP interfaces, SVG uploads, Office files (DOCX, XLSX are ZIPs with XML), RSS, SAML.
• Defence: Disable DTDs and external entities in the parser (a setting in most libraries, for example disallow-doctype-decl), use current libraries, JSON instead of XML where possible.
• Checking: Test documents with entities in development and tests, dependency checks.
• Context: On the list of the most common web risks (OWASP).

See also: SQL injection