Definition
An XML external entity XXE is a vulnerability that occurs when an XML parser processes XML input containing references to external entities. These external entities can point to sensitive files on the server or even external network resources. An attacker exploits this by crafting malicious XML input that tricks the parser into fetching and revealing data it should not access. This can lead to information disclosure, denial of service, or server-side request forgery SSRF attacks. For instance, an attacker might use XXE to read sensitive configuration files like /etc/passwd. Unlike XML injection, which manipulates XML structure, XXE specifically targets the parser's ability to resolve external references. XXE is a critical concept tested on security certifications like CompTIA Security+ and CySA+.