Project: WASC Threat Classification
Threat Type: Attack
Reference ID: WASC-43
XML External Entities (XXE) Attack
This technique takes advantage of a feature of XML to build documents dynamically at the time of processing. An XML message can either provide data explicitly or by pointing to an URI where the data exists. In the attack technique, external entities may replace the entity value with malicious data, alternate referrals or may compromise the security of the data the server/XML application has access to.