XXe

XXe, short for XML External Entity, is a security vulnerability that arises when an XML parser processes untrusted input containing references to external entities. If the parser resolves these entities, an attacker may access local files, make requests from the server to internal or external resources, or consume excessive resources, leading to information disclosure, server-side request forgery (SSRF), or denial of service.

Mechanism: In XML, a document can declare a DOCTYPE with an ENTITY that points to a system identifier such as a file or a URL. When the parser resolves the entity, the referenced content can be incorporated into the program’s data flow. Some configurations also allow recursive or nested expansions, which can exhaust CPU or memory and crash the service. Not all XML parsers are vulnerable; many provide secure defaults or allow disabling DTD processing or external entity resolution.

Impact: In vulnerable deployments, XXe can enable disclosure of sensitive configuration data, credentials, or internal file contents; it can be leveraged to interact with internal networks (SSRF) or to cause denial of service by consuming resources. The exact risk depends on the environment, the data processed, and the privileges of the process performing the XML parsing.

Mitigation: Disable DTD processing and external entity resolution in XML parsers, or enable secure processing modes offered by libraries. Apply patches and follow secure defaults for libraries and runtimes. Run XML processing in restricted sandboxes or with the minimum necessary privileges, and consider alternative data formats when possible. Regularly test applications with security scanners and reviews to detect vulnerable configurations.