Overview
XXE (XML External Entity) vulnerabilities arise from how XML parsers process certain features of XML. To understand XXE, you first need to understand XML and how applications parse it. This lesson introduces XML parsing.
Learning objectives
- Explain what XML is and where it is used.
- Describe how applications parse XML input.
- Identify that parser features, not XML data, create risk.
Core concept
XML (eXtensible Markup Language) is a structured, tag-based data format used in many contexts — document formats, configuration, SOAP web services, and various file types (some of which are XML under the hood). Applications process XML with an XML parser, a library that reads XML input and turns it into data the application can use.
XML has advanced features — including document type definitions (DTDs) and entities — that parsers may support. It is these parser features, when enabled on untrusted input, that create the XXE risk (not XML data itself).
How it works
When an application accepts XML input (an uploaded document, an API request body, a file that is internally XML), it hands the data to an XML parser to interpret. Parsers can support powerful legacy features like DTDs and entities (placeholders that expand to other content). If a parser is configured to process these features on untrusted XML, an attacker can include entity definitions that the parser will expand — the mechanism behind XXE (detailed next). The risk is therefore a matter of parser configuration, not a flaw in XML as a format.
Practical example
A service accepts XML — say, an uploaded document or an API payload — and parses it to extract fields. Under the hood, the XML parser may, by default in some libraries, process DTDs and entities. If it does so on attacker-supplied XML, features like external entities become available to the attacker. Note that many file formats (certain office documents, feeds, SVG images) are XML internally, so "we don't have an XML API" does not mean no XML is parsed — a common blind spot.
Cybersecurity relevance
XXE affects any application that parses untrusted XML with a parser that has dangerous features enabled — and XML lurks in more places than developers expect (document formats, SVGs, feeds, SOAP). Because the vulnerability stems from parser configuration, the defense is likewise configuration-based (disabling DTDs/external entities), covered later. Recognizing where XML is parsed — including inside file formats — is the first step to identifying XXE exposure. This lesson sets up the entity mechanism and its defenses.
Common mistakes
- Assuming no XML is processed when file formats (office docs, SVG, feeds) are XML internally.
- Blaming XML the format rather than the parser's enabled features.
- Overlooking XML parsing in APIs/SOAP and document-processing features.
Key takeaways
- XML is a tag-based data format used in documents, config, SOAP, and many file types; applications process it with an XML parser.
- XML's advanced features (DTDs, entities) create the XXE risk when a parser processes them on untrusted input — it is a parser-configuration issue, not an XML-data flaw.
- XML appears in unexpected places (office docs, SVG, feeds), so recognizing where untrusted XML is parsed is the first step to finding XXE.
Check your understanding
- Why is XXE described as a parser-configuration problem rather than a flaw in XML itself?
- Why might an application be parsing XML even without an obvious "XML" feature?