XML External Entity (XXE) Injection

Exploits XML parser processing of external entity references to read files or pivot internally.

Core Principles & Analysis

• Added to the OWASP Top 10 in its 2017 revision.
• Can pivot into SSRF against internal network services.
• Prevented by disabling external entity resolution in XML parsers.

Specifications & Metrics

• CVE: CWE-611
• IMPACT: High