1364
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1015 Limit Access 2430
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 19 Data Processing Errors 2309
Applicable Platforms
Language : XML (Prevalence = Undetermined)
Technology : Web Based (Prevalence = Undetermined)
Alternate Terms
XXE : An acronym used for the term "XML eXternal Entities"
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Read Files or Directories
If the attacker is able to include a crafted DTD and a
default entity resolver is enabled, the attacker may be able
to access arbitrary files on the system.
Integrity Bypass Protection Mechanism
The DTD may include arbitrary HTTP requests that the
server may execute. This could lead to other attacks
leveraging the server's trust relationship with other entities.
Availability DoS: Resource Consumption (CPU)
DoS: Resource Consumption (Memory)
The product could consume excessive CPU cycles or
memory using a URI that points to a large file, or a device
that always returns data such as /dev/random. Alternately,
the URI could reference a file that contains many nested or
recursive entity references to further slow down parsing.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
CWE Version 4.14
CWE-611: Improper Restriction of XML External Entity Reference
CWE-611: Improper Restriction of XML External Entity Reference