Cybersecurity glossary
What is XML External Entity (XXE) Injection?
Learn what XML External Entity (XXE) injection is, how malicious DTDs read files or hit internal URLs, real-world impacts, and how to disable external entities safely.
Definition
XML External Entity (XXE) injection is an attack against XML parsers that process Document Type Definitions (DTDs), allowing adversaries to define external entities that disclose files, trigger SSRF-like requests, or cause denial of service when untrusted XML is parsed insecurely.
Why XXE still surprises teams
XML remains embedded in enterprise protocols, office formats, and legacy integrations. Default parser settings in older stacks often expand external entities. That single misconfiguration turns “upload an XML file” into “read /etc/passwd.”
XXE injection is a parsing-safety problem first, a payload problem second.
How XXE works
Application accepts XML
API, file upload, or SOAP/SAML message reaches an XML parser.
Attacker includes a hostile DTD
External entities point at files or URLs the server can reach.
Parser expands entities
Insecure configuration fetches or includes the referenced resource.
Data returns or side effects occur
File contents appear in errors/responses, or internal HTTP calls fire.
Impact expands
Secrets disclosure, internal recon, or denial of service.
Common impact types
Local file disclosure
Read configuration files, keys, and credentials from disk.
SSRF-like fetches
Force HTTP requests to metadata services or internal apps.
Denial of service
Entity expansion bombs exhaust memory and CPU.
Blind XXE
Out-of-band channels exfiltrate data when responses hide content.
Prevention controls
| Control | Notes |
|---|---|
| Disable DTDs / external entities | Primary fix—configure parser features explicitly |
| Use safe defaults | Upgrade libraries; prefer APIs that disallow XXE by default |
| Least privilege | Parser process should not read sensitive paths unnecessarily |
| Network egress limits | Reduce SSRF-style impact if fetches still possible |
| Avoid XML when unused | Prefer JSON/other formats for new APIs when practical |
- Inventory every XML parser in apps, gateways, and document pipelines.
- Explicitly disable external entities, DTDs, and XInclude where applicable.
- Add regression tests that attempt classic XXE payloads.
- Keep XML libraries patched; review secure-coding notes per language.
- Sandbox document conversion workers with tight filesystem and egress controls.
- Treat SAML and SOAP stacks as high-priority XXE review targets.
- Do not rely on WAF signatures as the only XXE control.
- Monitor for unusual outbound requests from XML-processing hosts.
The practical takeaway
XXE abuses XML entity expansion to read files, hit internal URLs, or crash parsers. Disable external entities and DTDs wherever untrusted XML is parsed.
If your stack still “just parses XML” with defaults from a decade ago, assume XXE until you prove otherwise.
Related security terms
Server-Side Request Forgery (SSRF)
XXE can cause server-side fetches similar to SSRF.
Local File Inclusion (LFI)
XXE often aims at reading local files like LFI.
Deserialization Attack
Another untrusted-data parsing risk class.
Web Application Firewall (WAF)
May detect some XXE payloads; parser hardening is primary.
Frequently asked questions
What is XXE in simple terms?
If your app parses XML and allows external entities, attackers can make the parser open local files or URLs and return the contents.
Where does XXE appear?
SOAP services, SAML parsers, document converters, office file processors, and any API that accepts XML uploads.
What can attackers achieve with XXE?
Read sensitive files, scan internal networks, cause billion-laughs DoS, and sometimes escalate to further compromise.
How do you prevent XXE?
Disable DTDs and external entities in the XML parser, prefer safe libraries/defaults, and avoid parsing untrusted XML when possible.
Is JSON immune to XXE?
JSON parsers do not have XML entities. XXE is specific to XML (and similar) stacks—though other injection risks still apply.
Can a WAF fully stop XXE?
No. Harden parsers. WAFs may help detect obvious payloads but are not a complete fix.
References
Explore authoritative guidance and frameworks related to xml external entity (xxe) injection.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.