XXE
XML external entity injection
An XML parser resolves entities that point to files or URLs, exposing local files or making server-side requests. Disable DTDs or external entity resolution.
- Also called
- XML external entity
- Fix it in your stack
- XML external entity (XXE) processing fix cards (3 stacks) · CWE-611 page
- Defined in
- MITRE CWE-611
- Identifiers
- CWE-611: XML external entities (XXE)
Covered in
Parse bounded JSON and XML into an explicit application schema
Separate parser capabilities from schema rules, reject ambiguous and coercible inputs, and implement the boundary in a complete Python project.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Convert untrusted office documents and PDFs in an isolated parser
DOCX, XLSX and ODF files are ZIP archives of XML, and PDFs can carry scripts; the converters that read them are large C and C++ programs with a long CVE history. Check the package before any parser reads it, convert each document in a container with no network, no writable root and hard limits, kill it at a deadline, and re-render to pixels when people will open the result.
SAML single sign-on: verify signed assertions without losing the identity boundary
Bind a validated SAML assertion to its trusted issuer, the exact signed element, your service, the browser request and a replay record before creating a local session, and keep your SAML library ahead of its advisories.
Practice: SQL injection lab: Separate SQL structure from data with sqlite3 · OS command injection lab: Run git without a shell · SSTI lab: Render a welcome banner without template injection · XXE lab: Parse an uploaded invoice without resolving external entities