What is an XXE Vulnerability?

An XML External Entity vulnerability, or XXE, appears when an XML parser processes a document type definition and resolves external entities from untrusted XML. An attacker can reference a local file or URL and make the server include its content while parsing.

Possible consequences include reading files, SSRF, internal network access and denial of service. In blind XXE, data is not shown directly but may be sent through DNS or an outbound HTTP request. Modern parser defaults are often safer, but behavior varies between libraries and versions.

How can XXE be prevented?

• - Disable DTD processing and external entity resolution for untrusted XML.
• - Use a maintained parser with secure defaults and configure it explicitly.
• - Prefer simpler formats such as JSON when XML features are not needed.
• - Restrict file access and outbound network connections from the parsing service.

Code examples: vulnerable and secure XML parsers

The exact hardening depends on the parser. DTDs and external resources should be disabled explicitly instead of relying on version-dependent defaults.

PHP with DOMDocument

// Vulnerable: load DTDs and substitute entities
$dom = new DOMDocument();
$dom->loadXML($xml, LIBXML_DTDLOAD | LIBXML_NOENT);

// Safe for untrusted XML
if (stripos($xml, '<!DOCTYPE') !== false) {
    throw new InvalidArgumentException('DTD is not permitted');
}

$options = LIBXML_NONET;
if (defined('LIBXML_NO_XXE')) { // PHP 8.4 with newer libxml
    $options |= LIBXML_NO_XXE;
}
$dom->loadXML($xml, $options);

Do not enable LIBXML_NOENT or LIBXML_DTDLOAD for external input. LIBXML_NONET blocks network access; LIBXML_NO_XXE is available only in newer PHP/libxml combinations.

Java with DocumentBuilderFactory

// Vulnerable: parser without explicit boundaries
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
Document document = factory.newDocumentBuilder().parse(input);

// Safe: reject DTDs and external resources
factory.setFeature(
    "http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature(
    "http://xml.org/sax/features/external-general-entities", false);
factory.setFeature(
    "http://xml.org/sax/features/external-parameter-entities", false);
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
Document document = factory.newDocumentBuilder().parse(input);

Configure the factory before creating the builder. If a parser implementation rejects a security feature, the application must not silently fall back to an unsafe configuration.

.NET with XmlReader

// Vulnerable: DTD processing and resolver enabled
var unsafeSettings = new XmlReaderSettings {
    DtdProcessing = DtdProcessing.Parse,
    XmlResolver = new XmlUrlResolver()
};

// Safe: prohibit DTDs, remove resolver and limit input
var settings = new XmlReaderSettings {
    DtdProcessing = DtdProcessing.Prohibit,
    XmlResolver = null,
    MaxCharactersInDocument = 1_000_000
};
using var reader = XmlReader.Create(stream, settings);
var document = XDocument.Load(reader);

Python with lxml

# Vulnerable: load DTD and resolve entities
unsafe_parser = etree.XMLParser(
    load_dtd=True,
    resolve_entities=True
)
root = etree.fromstring(xml_bytes, unsafe_parser)

# Safe: no entities, no DTD and no network
safe_parser = etree.XMLParser(
    load_dtd=False,
    resolve_entities=False,
    no_network=True
)
root = etree.fromstring(xml_bytes, safe_parser)

If the application does not need DTD features, rejecting them completely is most robust. If DTDs are required, use a trusted local catalog, a narrow resolver and process isolation.

Where can XXE still occur?

Besides obvious XML APIs, XML can be hidden inside office documents, SVG images, SAML messages and SOAP requests. File conversion and import features therefore deserve the same review as direct XML endpoints.

What are external entities and DTDs?

A Document Type Definition can define entities that the parser replaces while reading the document. An external entity points to a file or URL. The feature was designed for reusable content, but with untrusted documents it connects input to local and remote resources available to the server. Parameter entities and external DTDs also enable more complex processing when the application does not display the direct parser output.

What impact is possible?

• File disclosure:
  readable configuration or system files become part of the parsed XML output.
• SSRF:
  the parser requests internal services, cloud metadata or a controlled external system.
• Blind XXE:
  data or proof leaves the server through outbound DNS or HTTP connections.
• Denial of service:
  recursive or rapidly expanding entities consume memory and CPU.

How is XXE tested?

The first step identifies which uploads and endpoints actually parse XML. A harmless local value or controlled callback domain shows whether DTDs and external entities are resolved. For archive-based formats, modified XML has to be placed back into a valid container. Requests to internal production addresses and large entity expansions should be avoided. Parser configuration and library version provide the strongest evidence during source review.

Why network restrictions still matter

Disabling DTDs and external entities addresses the cause. Minimal file permissions and restricted outbound access additionally limit what a misconfigured parser can reach. An isolated conversion service is useful for complex office and graphics formats. XML schema validation alone does not prevent XXE because dangerous resolution often happens before schema validation begins.