OWASP XML External Entities

XML External Entity risk, often called XXE, appears when an application reads XML files with a parser that follows risky instructions hidden inside the file. The parser may then read private files, contact internal servers, or consume huge amounts of memory. Safe parser settings remove the problem completely.

XML in Plain Words

XML is a text format that describes data with tags. Many systems exchange XML: office documents, image files in SVG format, payment messages, and older web services. XML also supports a feature called an entity, which works like a shortcut that the parser replaces with other content.

Picture an assistant who receives a note that says, "Fetch the document from the locked cabinet and paste it here." A careful assistant checks permission first. A careless assistant obeys. A vulnerable XML parser behaves like the careless assistant.

How the Weakness Works

 Sender submits XML file
          |
          ↓
+---------------------------+
|   Application parser      |
|   (external entities ON)  |
+---------------------------+
      |             |
      ↓             ↓
 Reads local     Contacts internal
 server files    network addresses
      |             |
      ↓             ↓
 Content returns inside the response or an error message

The file itself carries the dangerous instruction. The sender needs no special account, only a place where the application accepts XML.

What Attackers Can Reach

Impact	Plain Meaning
File disclosure	Private server files appear in responses
Internal request forgery	The server contacts systems hidden from the internet
Denial of service	A tiny file expands into gigabytes of data in memory

Where XML Hides

• File upload features that accept office documents or SVG images.
• SOAP web services and older APIs.
• Single sign-on messages in SAML format.
• Configuration imports and data feeds from partners.

Developers sometimes forget these entry points because the feature does not look like XML to the user.

How to Prevent XXE

Turn Off Dangerous Features

Disable document type definitions and external entity resolution in the parser. Most XXE flaws exist only because default settings in older parsers stay permissive.

Safe Parser Examples

Python developers can use the defusedxml library.

from defusedxml import ElementTree

tree = ElementTree.fromstring(xml_text)

Java developers can reject document type declarations entirely.

factory.setFeature(
    "http://apache.org/xml/features/disallow-doctype-decl", true);

Choose Simpler Formats

JSON carries no entity feature. When a project controls both sides of an exchange, JSON removes the risk.

Extra Layers of Defense

1. Update XML libraries and processors regularly.
2. Validate uploaded files by type and size before parsing.
3. Run the parser with the lowest privileges possible.
4. Block outbound network traffic from servers that have no reason to call out.
5. Scan code with static analysis tools that flag unsafe parser settings.

How to Recognize the Risk During Review

Search the codebase for XML parser creation. Confirm that each one disables external entities and document type definitions. Check third-party libraries that parse documents on your behalf, because they carry the same risk.

Key Takeaways

• XXE turns a harmless-looking XML file into a command for the parser.
• Impact ranges from file disclosure to internal network access and service outages.
• Disabling external entities and document type definitions stops the attack.
• Many hidden features, such as SVG upload and SAML login, use XML behind the scenes.