Skip to content © 2026 Jer Catallo. Reference material only, always confirm against the official source.
XML External Entity (XXE) Injection incident response playbook · Cybersecurity Atlas
Home Playbook XML External Entity (XXE) Injection
XML External Entity (XXE) Injection Network & Infrastructure A05:2021 – Security Misconfiguration
Attackers exploit XML parsers with external entity processing enabled to read local files, perform SSRF, or cause denial of service through entity expansion attacks.
1 Disable external entity processing in all XML parsers immediately. 2 Audit logs for evidence of file read or out-of-band exfiltration. 3 Restrict outbound network access from services that process XML. Disable DTD processing and external entity resolution in XML parser configurations.
2 Use JSON instead of XML where possible to eliminate the attack surface.
3 If XML is required, use a safe XML parser with a known-secure configuration.
4 Validate XML against a strict allowlist schema before processing. 1 Include XXE-specific test cases in your DAST scans and penetration tests. 2 Use SAST tools to detect unsafe XML parser instantiation in code. 3 Review all file upload endpoints that process XML-derived formats (SVG, XLSX, DOCX). 4 Maintain an inventory of all XML parsing libraries and their versions. XML input in REST or SOAP APIs with external entity resolution enabled SVG file uploads processed by a server-side XML parser XLSX/DOCX file processing with an unsafe XML parser Blind XXE via out-of-band data exfiltration (DNS/HTTP callbacks) XML payloads with DOCTYPE declarations and ENTITY definitions in logs Unexpected DNS lookups or HTTP requests from the parser process Application returning content of local files in error messages OWASP ZAP Burp Suite Collaborator XXEinjector (authorized) Semgrep
