What are the best ways to prevent XML external entity (XXE) attacks?

1 What is an XML external entity?

An XML external entity is a special construct in an XML document that allows the inclusion of data from an external source. For example, you can use an external entity to reference a file, a URL, or another XML document. The syntax for an external entity looks like this: &name; , where name is a predefined identifier that points to the external source. The XML parser will replace the entity with the content of the source when processing the document.

2 How does an XXE attack work?

An XXE attack works by exploiting a vulnerable XML parser that does not properly handle external entities. An attacker can craft a malicious XML document that contains an external entity that references a sensitive file, a malicious URL, or a system command. The attacker can then send the document to the target application, which will process the entity and expose the data, execute the code, or cause an error. For example, an attacker can use an XXE attack to read the /etc/passwd file from a server by sending this document:

<?xml version="1.0"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>        

3 What are the impacts of an XXE attack?

The impacts of an XXE attack vary depending on the type and scope of the external entity and the permissions of the XML parser. For instance, an attacker could access confidential or personal data from the server, such as passwords, credentials, configuration files, or database records. Additionally, they could execute arbitrary code on the server, such as commands, scripts, or malware. Furthermore, they could cause a denial of service by using an external entity that consumes a lot of resources, such as a large file, a recursive entity, or an infinite loop. Therefore, it is important to be aware of the potential risks associated with XXE attacks.