Improper Restriction of XML External Entity Reference ('XXE')
Description
External XML entities can be abused to read files, communicate with external hosts, exfiltrate data, or cause a Denial of Service (DoS). XML parsers and document loaders must be configured to not resolve entities.
Examples
Insecure Code
c#
var doc = new XmlDocument(); doc.Load("users.xml");Secure Code
c#
var doc = new XmlDocument(); doc.XmlResolver = null; doc.Load("users.xml");Remediation
Set XmlDocument's XmlResolver to null or use XDocument which disables entity resolution.
Rule Details
| Field | Value |
|---|---|
| ID | CODE-0453 |
| Category | Injection |
| Severity | MEDIUM |
| CWE | CWE-611 |
| Confidence | HIGH |
| Impact | HIGH |
| Likelihood | MEDIUM |
| Exploitability | EASY |
| Tags | XXE, XML External Entity |
| OWASP | A1:2017-Injection, A03:2021-Injection |