阅读中文版本

XML External Entity Injection

XXE abuses XML parsers that resolve external entities, letting an attacker read local files or reach internal services through a crafted document.

Definition

XML external entity injection is an attack in which a document declares an entity that points to an external resource, causing a misconfigured parser to fetch local files or network endpoints.

It affects any service that parses XML from untrusted input, including SOAP endpoints, document converters, and SAML consumers. Compared to simpler alternatives, this concept fits best when the trade-off it represents is the one the system actually cares about.

When to use it

A common use case is applying it at the boundary where the cost of getting it wrong is highest, and the scenario usually involves a concrete guarantee the system must uphold. Unlike an ad hoc approach, it makes that guarantee explicit, reviewable, and testable.

How it works

Entities can reference file URLs or remote URLs, so a vulnerable parser may disclose file contents in an error or response and can be used for server-side request forgery.

The reliable mitigation is to disable external entities and DTD processing entirely unless a document type genuinely requires them.

Trade-offs and alternatives

Billion laughs and similar entity expansion attacks share the same configuration surface, so hardening the parser addresses both disclosure and denial of service. The main drawback is the extra complexity it introduces, so the benefit should clearly outweigh that cost before a team adopts it.

Common misconceptions

A persistent misconception is that modern XML parsers are safe by default. Another is that XXE only allows reading files and cannot cause server-side requests. For example, an engineer who assumes otherwise may design around a guarantee that does not actually exist, which only becomes obvious under load or failure.

Anti-patterns to avoid

Two recurring anti-patterns are to enabling external entity resolution to support a legacy document format and to parsing user-supplied XML with a general-purpose default configuration. Both tend to surface as hard-to-debug production issues rather than obvious test failures. Related concepts include NoSQL Injection, LDAP Injection, HTTP Response Splitting.