Overview
The heart of XXE is the external entity — an XML feature that tells the parser to pull in content from an external source. When processed on untrusted input, it enables the attack. This lesson explains external entities conceptually and defensively.
Learning objectives
- Define XML entities and external entities.
- Explain how external entities enable XXE.
- Describe the potential impact.
Core concept
XML entities are placeholders that the parser expands into other content. An external entity instructs the parser to fetch content from an external resource (such as a file on the server or a URL) and include it. When a parser processes external entities on attacker-controlled XML, the attacker can define an external entity pointing at a resource the server can access — and the parser may retrieve and include it, exposing that content or triggering a server-side request.
How it works
If external-entity processing is enabled, an attacker submitting XML can declare an external entity referencing a local file or a URL, and reference that entity in the document. The parser, honoring the feature, resolves the entity — reading the file's contents (potential file disclosure) or making a request to the URL (an SSRF-like effect from the parser). Additional variants can cause denial of service through entity expansion. The unifying cause is the parser expanding attacker-defined external entities; the impact depends on what the server can read or reach.
Practical example
An application parses uploaded XML with external entities enabled. An attacker submits a document that defines an external entity referencing a server-side file and uses it where the app will read the value — for example, in a field the app echoes back. The parser expands the entity by reading that file, and its contents end up disclosed to the attacker. Alternatively, pointing the entity at an internal URL makes the parser issue a request to it (SSRF-like). Disabling external-entity processing (next lesson) prevents all of this.
Cybersecurity relevance
XXE via external entities can lead to sensitive file disclosure (reading server files), SSRF-style internal requests (including cloud metadata, tying to the SSRF module), and denial of service — a high-impact vulnerability class. It has appeared in real breaches of XML-processing applications and services. Because the mechanism is the parser expanding attacker-defined external entities, the defense is to disable DTDs/external entities in the parser (covered next). Testers submit XML with entity definitions to test parser behavior; defenders harden the parser configuration.
Common mistakes
- Leaving external-entity/DTD processing enabled on parsers handling untrusted XML.
- Underestimating impact — XXE can disclose files and reach internal systems, not just cause errors.
- Forgetting XXE can produce SSRF-like effects, linking to internal-service and metadata exposure.
Key takeaways
- XML entities are placeholders the parser expands; external entities pull in content from external resources (files or URLs).
- Processing attacker-defined external entities lets an attacker disclose server files, trigger SSRF-like requests, or cause denial of service.
- The cause is parser expansion of external entities; the defense is disabling DTDs/external entities — XXE is a high-impact class linked to file disclosure and SSRF.
Check your understanding
- What is an external entity, and how does processing one on untrusted XML enable XXE?
- Name two distinct impacts an XXE vulnerability can have.