XML external entity injection (XXE)
An XML parser resolves untrusted external entities across an unintended file or network boundary.
Candidate CWE: CWE-611
Test hypothesis#
In a local XML fixture, compare a literal marker field with one external entity referencing your controlled HTTP canary. Correlate parser input and receiver log; avoid recursive entities and sensitive files.
Evidence required#
The external entity fetch occurs at the parser, or its controlled marker is returned in parsed output. Record whether the consequence is blind fetch or readable content.
Rule out false positives#
Accepting XML or DOCTYPE, a parser error, or a browser-side request without server entity resolution is insufficient.
Playbook and command references#
- Uploads, downloads, paths, archives, and XML — Follow a file through acceptance, storage, processing, publication, and retrieval while preserving ownership and path boundaries.
- Server-side fetching and network trust boundaries — Separate an intended fetch from a request that reaches a prohibited destination, forwards authority, or exposes a protected response.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the mapping guide.