Security Test: XXE Injection¶

Scanner(s) Support¶

Description¶

Default Severity: high

XXE vulnerabilities occur when an XML parser processes external entities, which can allow attackers to trick the system into accessing sensitive files or making requests to internal resources. Developers sometimes use default parser configurations that leave this door open, so attackers might exploit XML input to read confidential data, trigger unwanted actions on the server, or even run malicious code. This risk emphasizes the importance of carefully configuring XML parsers, validating input, and disabling any unnecessary external references.

Reference:

• http://projects.webappsec.org/XML-External-Entities

Configuration¶

Identifier: injection/xxe

Examples¶

All configuration available:

checks:
  injection/xxe:
    skip: false # default

Compliance and Standards¶