Injection: XXE Injection¶

Identifier: xxe

Scanner(s) Support¶

GraphQL Scanner	REST Scanner	WebApp Scanner

Description¶

XXE vulnerabilities occur when an XML parser processes external entities, which can allow attackers to trick the system into accessing sensitive files or making requests to internal resources. Developers sometimes use default parser configurations that leave this door open, so attackers might exploit XML input to read confidential data, trigger unwanted actions on the server, or even run malicious code. This risk emphasizes the importance of carefully configuring XML parsers, validating input, and disabling any unnecessary external references.

References:

http://projects.webappsec.org/XML-External-Entities

Configuration¶

Example¶

Example configuration:

---
security_tests:
  xxe:
    assets_allowed:
    - REST
    - GRAPHQL
    - WEBAPP
    skip: false

Reference¶

`assets_allowed`¶

Type : List[AssetType]*

List of assets that this check will cover.

`skip`¶

Type : boolean

Skip the test if true.