What is the XXE or XML External Entity attack?

The XML External Entity or XXE vulnerability is a type of computer security vulnerability that is found in many web applications. The attack occurs when an XML input that contains a reference to an external entity is processed by a weakly configured XML parser. Let’s understand this attack in more detail.

How does the XXE attack work?

XML or External Markup Language is a format used to describe the structure of a document, such as webpages. An entity in an XML document maps some name to a value. It uses the following syntax:

<!ENTITY entityName “The text you want to appear when the entity is used”>

An external entity is declared with a URI. The URI is dereferenced by an XML processor when processing the entity.

For example,

<?xml version=”1.0″ ?>
<!DOCTYPE author_info [
<!ELEMENT book ANY>
<!ENTITY book SYSTEM “file:///author/book”>
]>
<book>&book;</book>

In the above example, book is an external entity, which is declared by the URI file:///author/book. When the XML is parsed by the XML processor, ‘book’ will contain the contents of the file /author/book.

In the XXE attack, the attacker exploits this functionality to perform a DoS attack or steal sensitive information.

For example,

<?xml version=”1.0″ ?>
<!DOCTYPE foo [
<!ELEMENT bar ANY>
<!ENTITY bar SYSTEM “file:///dev/random”>
]>
<bar>&xxe;</bar>

In the above example, the URI of the external entity accesses a local source that may not return. As a result, if this XML is processed with a weakly configured XML processor, it will exhaust the …