XML External Entities

Project: WASC Threat Classification

Threat Type: Attack

Reference ID: WASC-43

 

XML External Entities (XXE) Attack

This technique takes advantage of a feature of XML to build documents dynamically at the time of processing. An XML message can either provide data explicitly or by pointing to an URI where the data exists. In the attack technique, external entities may replace the entity value with malicious data, alternate referrals or may compromise the security of the data the server/XML application has access to.