Improper Restriction of XML External Entity Reference

This vulnerability occurs when an application processes XML input without properly restricting external entity references. Attackers can exploit this to read local files, trigger internal network requests, or cause denial of service.

XML parsers often support Document Type Definitions (DTDs), which can define custom entities. When these entities point to external URIs (like file://, http://), the parser may fetch and include that external content. An attacker can inject a malicious DTD that references sensitive system files (e.g., /etc/passwd, C:\Windows\win.ini) or internal endpoints, leading to data exposure or server-side request forgery (SSRF). The retrieved data is often reflected in the application's output, such as error messages or API responses. Preventing XXE requires disabling DTD processing entirely or securely configuring the XML parser to reject external entities. Since manual code reviews and traditional SAST tools can miss parser configurations, managing this at scale is difficult; an ASPM like Plexicus can help you track and remediate these flaws across your entire stack by correlating findings with actual runtime behavior and suggesting prioritized fixes.