A rigged XML document.
One local file read.
A vulnerable XML parser resolves an external SYSTEM entity and returns the content of an internal file. The attack happens in a single request.
XML document received
An exposed internal XML service
The application accepts XML files to import data or configure a service.
An often-forgotten XML interface
XML import, SOAP webservice, configuration API: these entry points can process documents without checking for external entities.
Key figures
A03
OWASP Top 10 · 2021
Injection (incl. XXE)
0
Clicks required
for the attack
0
Local file read
/etc/passwd or .env
∞
Data exposed
from a single request
Technical demo
Try it yourself
This simulation lets you send a malicious XML document and watch a vulnerable parser's behavior in a controlled environment.
Interactive demo
Inject an XXE payload
No injection simulated
Choose a payload or type your own, then click Simulate
External XML entity
The XML parser reads a remote or local SYSTEM entity. If external entities are enabled, the server can load a system file or an internal resource.
How to protect against it
- Disable DTDs and external entities in the XML parser.
- Validate XML documents before processing.
- Use a secure parser with no external resource loading.