Skip to content

External parameter entities allowed in XML parser

Description

External parameter entities are enabled via "http://xml.org/sax/features/external-parameter-entities". This may lead to XML External Entity (XXE) vulnerabilities, allowing local file disclosure, denial of service, and Server-Side Request Forgery (SSRF).

Examples

Insecure Code

java
$PARSER.setFeature("http://xml.org/sax/features/external-parameter-entities", true);

Secure Code

java
parser.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

Remediation

Set the feature to `false`: parser.setFeature("http://xml.org/sax/features/external-parameter-entities", false); Additionally, consider disabling DOCTYPE declarations, general external entities, XInclude, and entity expansion if applicable.

Rule Details

FieldValue
IDCODE-0233
CategoryInjection
SeverityMEDIUM
CWECWE-611
ConfidenceHIGH
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityMODERATE
TagsXXE, XML
OWASPA05:2021-Security Misconfiguration