XML External Entity (XXE) injection is an attack against applications that parse XML input. If the XML parser is configured to process external entities, an attacker can make it read local files, send requests to internal systems, or exhaust server resources.

How it works

XML documents can include a Document Type Definition (DTD), and a DTD can declare entities: named values that are substituted into the document. An external entity takes its value from a URL or a file path. If an attacker can supply XML containing an external entity that points to a file such as a password file, the parser loads that file and the application may return its contents.

XXE can also be used to make the server send requests to internal addresses (server-side request forgery) and, with nested entities, to cause denial of service.

See it in action

How to defend against XXE

• Disable external entities and DTD processing in your XML parser. This is the most effective fix, and most modern parsers support it with a single setting.
• Prefer simpler data formats such as JSON where XML is not required.
• Keep XML libraries up to date.
• Validate incoming XML against a schema, and reject documents that contain a DOCTYPE declaration if you do not need one.
• Set limits on document size and parsing time.

How Vooki Pro helps

• Tests XML inputs for XXE and XML injection.
• Checks for XML bombs (entity expansion denial of service).
• Tests related SSRF paths that XXE is often used to reach.

Frequently asked questions

How do I prevent XXE?

Disable external entities and DTD processing in your XML parser; most modern libraries support this with a single setting.

Can XXE lead to SSRF?

Yes. An external entity can point to an internal URL, making the server fetch it.

Related: Server-side request forgery (SSRF) and cloud metadata attacks · Insecure deserialization