XML External Entity (XXE) Injection
XXE injection exploits vulnerable XML parsers that process external entity references. Attackers can read local files, perform server-side request forgery (SSRF), execute denial-of-service attacks, or in some cases, achieve remote code execution.
Overview
XML External Entity (XXE) injection is a vulnerability that targets applications parsing XML input. XML allows the definition of custom entities, including external entities that reference files on the server or remote URLs. When an XML parser processes these external entities without restrictions, attackers can exploit this to read arbitrary files, access internal services, or cause denial of service.
Types & Variants
Classic XXE
Reading local files from the server through external entity definitions.
Blind XXE
Exfiltrating data via out-of-band channels (DNS, HTTP) when direct output is not visible.
XXE DoS
The "Billion Laughs" attack uses recursive entity expansion to exhaust server memory.
Impact
Local file disclosure, SSRF, denial of service (billion laughs attack), port scanning of internal networks.
Examples
File Read via XXE
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>
Remediation
Disable external entity processing in XML parsers, use less complex data formats (JSON), validate and sanitize XML input, and update XML processing libraries.
Disable DTD processing and external entity resolution in all XML parsers
Use JSON instead of XML where possible
Validate XML against a strict schema (XSD)
Keep XML parsing libraries up to date
Related SuperClue scanner checks
These scanner checks look for signs of XML External Entity (XXE) Injection. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works