Glossary
XML EXTERNAL ENTITY / XXE
defined.
An attack against XML parsers that allows reading local files, performing SSRF, or causing denial-of-service via external entity declarations.
A–Z
An attack against XML parsers that allows reading local files, performing SSRF, or causing denial-of-service via external entity declarations.
If your application accepts XML and the parser resolves external entities (the default in some libraries), an attacker can include <!ENTITY xxe SYSTEM "file:///etc/passwd"> and read arbitrary files.
Defence: disable DOCTYPE / external entity processing in every XML parser you use. Most libraries (libxml2, Java DocumentBuilderFactory, .NET XmlReader) require explicit configuration.
See our web application penetration testing, API security testing, network penetration testing, and cloud security audit services for how we test for and defend against this class of issue.
30-minute call with an OSCP-certified engineer. Tailored proposal in 24 hours.