📋 What Is It?
XML External Entities (XXE) - Many older or poorly configured XML processors evaluate external entity references within XML documents, leading to disclosure of internal files, port scanning, remote code execution, and denial of service attacks.
#4
OWASP Rank 2017
2%
Apps Tested
47K
Occurrences
⚠️ Common Exploits
- File Disclosure: Read local system files
- SSRF: Scan internal network ports
- Denial of Service: Billion laughs attack
- Remote Code Execution: Execute malicious code
- Data Exfiltration: Steal sensitive information
🔴 Attack Flow
1. Attacker uploads malicious XML file
↓
2. XML parser processes external entities
↓
3. External entity references local files
↓
4. Parser returns file contents to attacker
↓
5. BREACH: Internal files exposed!
↓
2. XML parser processes external entities
↓
3. External entity references local files
↓
4. Parser returns file contents to attacker
↓
5. BREACH: Internal files exposed!
✓ Prevention Checklist
- Disable external entity processing in XML parsers
- Use less complex data formats like JSON
- Update XML processors and libraries
- Implement whitelist server-side input validation
- Use SAST tools to detect XXE vulnerabilities
📌 Quick Reference
Risk Level: HIGH RISK
Year: OWASP Top 10 2017
Category: WEB
Ranking: #4 in 2017