Zennoxa Shield
Application Security Glossary

XML External Entity (XXE)

XML external entity (XXE) is a vulnerability where an XML parser processes attacker-defined external entities, letting an attacker read local files, reach internal systems, or cause denial of service. It occurs when XML input from an untrusted source is parsed with external entity resolution enabled.

XML external entity (XXE) injection abuses a feature of the XML specification that lets a document define entities pointing to external resources. If a parser resolves these external entities while processing untrusted XML, an attacker can declare an entity that references a local file (file:///etc/passwd) or a network URL, causing the parser to fetch and expose that content or make requests on the server's behalf.

Beyond file disclosure, XXE can be leveraged for server-side request forgery against internal services and for denial of service (for example, the 'billion laughs' entity-expansion attack). The fix is to disable DTD processing and external entity resolution in the XML parser configuration — most modern libraries expose a flag or a secure-processing mode to do exactly this.

Tracked as CWE-611, XXE was historically its own OWASP Top 10 entry and now falls under the misconfiguration/injection landscape. Scanners flag XML parsers configured to allow DOCTYPE declarations or external entities on untrusted input.

Frequently asked questions

What is XML external entity (XXE)?
XXE is a vulnerability where an XML parser resolves attacker-defined external entities, letting an attacker read local files, reach internal systems, or cause denial of service. It occurs when untrusted XML is parsed with external entity resolution enabled.
How do you prevent XXE?
Disable DTD processing and external entity resolution in the XML parser configuration, using the library's secure-processing mode or equivalent flags. If a feature genuinely needs DTDs, restrict or allowlist what entities may resolve and avoid fetching external resources.
How is XXE related to SSRF?
An XXE flaw can be used to perform server-side request forgery: because an external entity can reference a network URL, the XML parser can be coerced into making requests to internal services on the attacker's behalf, in addition to disclosing local files.

Related terms

XML External Entity (XXE) — Zennoxa Glossary — Zennoxa Shield