A4: XML External Entities (XXE) · 2017

Insecure XML processors can resolve external entities, allowing file reads, internal requests or denial of service.

Summary

Insecure XML processors can resolve external entities, allowing file reads, internal requests or denial of service.

How the attack works

The XML parser accepts an external entity and reads a local sample file when resolving the received document.

Example

Vulnerable · Pseudocode

<!DOCTYPE doc [
 <!ENTITY note SYSTEM "file:///tmp/demo.txt">
]>
<doc>&note;</doc>

Fix: Disable DTDs and external entity resolution in the XML parser.

Prevention

Disable DTDs and external entities in all XML parsers.
Prefer simple formats such as JSON when XML is unnecessary.
Update libraries and validate incoming XML content.

Lineage

2013 · A5: Security Misconfiguration Moves down to rank 6 in 2017
2017 · A4: XML External Entities (XXE) Integrated into Security Misconfiguration
2017 · A6: Security Misconfiguration Expanded with XXE in 2021
2021 · A05: Security Misconfiguration Absorbs XXE
2025 · A02: Security Misconfiguration Moves up from rank 5

2013:A5 → 2017:A6: Security Misconfiguration moves down one rank.
2017:A6 → 2021:A05: Security Misconfiguration moves up one rank.
2017:A4 → 2021:A05: XXE is integrated into Security Misconfiguration.
2021:A05 → 2025:A02: Security Misconfiguration moves up from rank 5 to 2.

Sources

Open official source ↗

Buy me a coffee