What is XXE (XML External Entity) injection?
Answer
XXE (XML External Entity) injection targets XML parsers that process external entity references in user-supplied XML. An external entity definition like <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> — when the XML is parsed, the parser reads the file and substitutes its contents. This allows: reading arbitrary files, SSRF (using http:// URIs), remote code execution (in some configurations), denial of service (billion laughs attack — entity expansion). Prevention: (1) Disable external entity processing in the XML parser configuration (most critical). In Java SAXParser: factory.setFeature("http://xml.org/sax/features/external-general-entities", false). (2) Use less complex formats like JSON instead of XML where possible. (3) Validate and sanitize XML input. (4) Use a WAF with XXE signatures. Many breaches have exploited XXE in enterprise applications.