Parsing and processing
XXE (XML external entity attack)
An attack in which a submitted document declares an external entity so that a trusting parser reads a local file or makes a request on the attacker's behalf.
The payload is a few lines of prolog: declare an entity pointing at file:///etc/passwd or at an internal URL, reference it in the body, and read the result back out of whatever the application echoes. Because the fetch is performed by the parser, it happens with the server's privileges and from inside the network perimeter.
The fix is not to sanitise the document — it is to configure the parser so external entities are never resolved, or to reject DOCTYPE outright. Our pipeline does the former: it will read such a document for well-formedness and refuse to expand anything.
- Defined in
- OWASP
- Category
- Parsing and processing
- Also written
- XML external entity injection, external entity attack
Shown, not asserted
All 2 claims are executed on every test run, against the same engines the tools use. If the behaviour changes, the test fails rather than this page quietly becoming wrong.
The classic payload is parsed but never resolved — nothing is fetched.
document.xml <!DOCTYPE d [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> <d>&xxe;</d>What the engine returns
Well-formed. The document is well-formed, but its structure could not be extracted: External entities are not supportedThe same shape aimed at an internal URL fares no better.
document.xml <!DOCTYPE d [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]> <d>&xxe;</d>What the engine returns
Well-formed. The document is well-formed, but its structure could not be extracted: External entities are not supported
What catches people out
- Blind XXE needs no echo. A parameter entity pointing at an attacker's server exfiltrates through the request itself, so "we never display the parsed document" is not a defence.
- Disabling only DTD loading is not enough on every parser. Disable external general and parameter entities explicitly, and prefer rejecting DOCTYPE.
- The defence belongs in parser configuration, not in input filtering. Escaping cannot help you here.
Where it bites
A definition on its own is trivia. These are the pages where this term decides whether a document works.
- ToolsXML validatorRuns the pipeline whose refusal is asserted above.
- FormatsSOAP envelopeThe classic target: an endpoint that accepts XML from anyone.
Related terms
- External entityAn entity whose replacement text lives outside the document, named by a SYSTEM or PUBLIC identifier and fetched when the entity is referenced.
- Parameter entityAn entity declared with <!ENTITY % name "…"> and referenced as %name;, usable only inside markup declarations rather than in document content.
- Document type declarationThe <!DOCTYPE root …> in the prolog that names the document's root element and points at, or contains, its markup declarations.
- Entity expansion attackA denial of service in which nested entity definitions expand exponentially, turning a few hundred bytes of document into gigabytes of text.
Get started
Bring order to the XML your team can't afford to ignore.
Create a free account and get a private workspace to search, validate, diff, and monitor your XML feeds, sitemaps, schemas, and vendor integrations.