XML external entity injection
Summary: XML external entity injection occurs when applications process user-supplied XML without disabling references to external resources, which XML parsers typically support by default even though applications rarely need them. Exploiting external entities can let an attacker retrieve arbitrary files from the parser's filesystem, cause denial of service by reading a file such as /dev/random, or make requests over HTTP to other systems, turning the vulnerable server into an attack proxy against third-party, internal, or loopback services.
Why it matters: A parser left on its defaults can be turned into a proxy that reaches internal services external attackers cannot otherwise touch, including ones on the application server's own loopback adapter.
Read the original at PortSwigger Research ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026