XML external entity (XXE) injection is a vulnerability in which an application’s XML parser processes attacker-defined entities that reference local files or remote URLs, leaking data or making the server send requests.
How XXE injection works
XML allows a document type definition (DTD) to declare entities – placeholders that the parser replaces with content. An external entity takes that content from a URI. If a parser accepts DTDs from untrusted input, an attacker can submit something like:
<!DOCTYPE x [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><x>&xxe;</x>
The server then reads the file and may return it in the response. The weakness is catalogued as CWE-611. Depending on the parser and configuration, XXE can lead to:
- reading configuration files, source code and credentials, similar to directory traversal;
- server-side request forgery against internal services and cloud metadata endpoints;
- “blind” data exfiltration through out-of-band DNS or HTTP requests;
- denial of service through recursive entity expansion (the “billion laughs” attack), and in rare cases code execution.
Why XXE matters
XML hides in many places: SOAP web services, SAML single sign-on messages, RSS feeds, SVG images and office documents such as DOCX and XLSX, which are ZIP archives of XML files. Older parsers in Java, .NET and PHP processed external entities by default. XXE had its own category (A4) in the OWASP Top 10 2017 and is now part of Security Misconfiguration.
How to prevent XXE injection
- Disable DTD processing and external entity resolution in every XML parser.
- Use hardened libraries such as Python’s defusedxml and keep parsers up to date.
- Prefer simpler formats such as JSON where XML is not required.
- Validate uploaded files and restrict outbound connections from servers.
