What Are XML External Entity (XXE) Attacks?
An XML external entity (XXE) attack abuses an XML parser that is configured — often by default — to resolve external entities. XML lets a document define entities that pull in content from a file or URL; if an attacker controls the XML and the parser honors those entities, they can read local files, trigger server-side requests, or exhaust resources. The flaw lives in parser configuration, not the data.
How does XXE work?#
XML supports a Document Type Definition (DTD) that can declare entities. A malicious one points somewhere it should not:
<?xml version="1.0"?>
<!DOCTYPE data [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<data>&xxe;</data>If the parser resolves &xxe;, it inserts the contents of /etc/passwd into the response. Swap
the file URL for http://169.254.169.254/... and XXE becomes
SSRF, reaching cloud metadata and internal services.
What can XXE achieve?#
| Technique | Impact |
|---|---|
file:// entity | Read local files (config, secrets) |
http:// entity | SSRF to internal systems |
| Nested/recursive entities | Denial of service (“billion laughs”) |
| Out-of-band entities | Exfiltrate data to an attacker server |
Why is disabling entities the fix?#
Because XXE is a configuration problem. Any XML feature you do not need is attack surface, and external entities are almost never needed. Turning off DTD and external-entity processing eliminates the class outright:
- Disable DTDs (
disallow-doctype-decl) or external entities in your parser. - Prefer simpler formats — JSON has no equivalent entity mechanism.
- Keep parser libraries patched.
XXE bridges injection and SSRF. Prefer safer formats and hardened parsers. More at the Web Security hub.
Frequently asked questions#
What is an XXE attack?
An XML external entity (XXE) attack abuses an XML parser configured to resolve external entities. By defining an entity that points at a local file or a URL, an attacker can make the parser read server files, perform server-side requests, or cause denial of service. It stems from insecure default XML parser settings.
How do you prevent XXE?
Disable external entity and DTD processing in your XML parser — most libraries have a one-line setting to do this, and it is the definitive fix. Where possible, prefer less complex formats like JSON. Input validation is not sufficient because the danger is in how the parser is configured, not just the content.