This vulnerability allows the usage of external entities in XML.

## Why is this an issue?

External Entity Processing allows for XML parsing with the involvement of external entities. However, when this functionality is enabled without proper precautions, it can lead to a vulnerability known as XML External Entity (XXE) attack.

### What is the potential impact?

#### Exposing sensitive data

One significant danger of XXE vulnerabilities is the potential for sensitive data exposure. By crafting malicious XML payloads, attackers can reference external entities that contain sensitive information, such as system files, database credentials, or configuration files. When these entities are processed during XML parsing, the attacker can extract the contents and gain unauthorized access to sensitive data. This poses a severe threat to the confidentiality of critical information.

#### Exhausting system resources

Another consequence of XXE vulnerabilities is the potential for denial-of-service attacks. By exploiting the ability to include external entities, attackers can construct XML payloads that cause resource exhaustion. This can overwhelm the system’s memory, CPU, or other critical resources, leading to system unresponsiveness or crashes. A successful DoS attack can disrupt the availability of services and negatively impact the user experience.

#### Forging requests

XXE vulnerabilities can also enable Server-Side Request Forgery (SSRF) attacks. By leveraging the ability to include external entities, an attacker can make the vulnerable application send arbitrary requests to other internal or external systems. This can result in unintended actions, such as retrieving data from internal resources, scanning internal networks, or attacking other systems. SSRF attacks can lead to severe consequences, including unauthorized data access, system compromise, or even further exploitation within the network infrastructure.

## How to fix it in Java SE

### Code examples

The following code contains examples of XML parsers that have external entity processing enabled. As a result, the parsers are vulnerable to XXE attacks if an attacker can control the XML file that is processed.

#### Noncompliant code example

    import javax.xml.XMLConstants;
    import javax.xml.parsers.DocumentBuilderFactory;

    public void decode() {
        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); // Noncompliant
    }

    import javax.xml.stream.XMLInputFactory;

    public void decode() {
        XMLInputFactory factory = XMLInputFactory.newInstance(); // Noncompliant
    }

#### Compliant solution

For `DocumentBuilderFactory`, `SAXParserFactory`, `TransformerFactory`, and `SchemaFactory` set `XMLConstants.FEATURE_SECURE_PROCESSING` to `true`.

    import javax.xml.XMLConstants;
    import javax.xml.parsers.DocumentBuilderFactory;

    public void decode() {
        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
    }

For `XMLInputFactory` set `SUPPORT_DTD` to `false`.

    import javax.xml.stream.XMLInputFactory;

    public void decode() {
        XMLInputFactory factory = XMLInputFactory.newInstance();
        factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
    }

Other combinations of settings are secure, but in general, it is recommendable to use the approaches shown here, as they are the most clear.

### How does this work?

#### Disable external entities

The most effective approach to prevent XXE vulnerabilities is to disable external entity processing entirely, unless it is explicitly required for specific use cases. By default, XML parsers should be configured to reject the processing of external entities. This can be achieved by setting the appropriate properties or options in your XML parser library or framework.

If external entity processing is necessary for certain scenarios, adopt a whitelisting approach to restrict the entities that can be resolved during XML parsing. Create a list of trusted external entities and disallow all others. This approach ensures that only known and safe entities are processed.
You should rely on features provided by your XML parser to restrict the external entities.

### Going the extra mile

#### Disable entity expansion

Specifically for `DocumentBuilderFactory`, it is possible to disable the entity expansion. Note, however, that this does not prevent the retrieval of external entities.

    factory.setExpandEntityReferences(false);

## How to fix it in Dom4j

### Code examples

The following code contains examples of XML parsers that have external entity processing enabled. As a result, the parsers are vulnerable to XXE attacks if an attacker can control the XML file that is processed.

#### Noncompliant code example

    import org.dom4j.io.SAXReader;

    public void decode() {
        SAXReader xmlReader = new SAXReader(); // Noncompliant
    }

#### Compliant solution

    import org.dom4j.io.SAXReader;

    public void decode() {
        SAXReader xmlReader = new SAXReader();
        xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
    }

### How does this work?

#### Disable external entities

The most effective approach to prevent XXE vulnerabilities is to disable external entity processing entirely, unless it is explicitly required for specific use cases. By default, XML parsers should be configured to reject the processing of external entities. This can be achieved by setting the appropriate properties or options in your XML parser library or framework.

If external entity processing is necessary for certain scenarios, adopt a whitelisting approach to restrict the entities that can be resolved during XML parsing. Create a list of trusted external entities and disallow all others. This approach ensures that only known and safe entities are processed.
You should rely on features provided by your XML parser to restrict the external entities.

## How to fix it in Jdom2

### Code examples

The following code contains examples of XML parsers that have external entity processing enabled. As a result, the parsers are vulnerable to XXE attacks if an attacker can control the XML file that is processed.

#### Noncompliant code example

    import org.jdom2.input.SAXBuilder;

    public void decode() {
        SAXBuilder builder = new SAXBuilder(); // Noncompliant
    }

#### Compliant solution

    import org.jdom2.input.SAXBuilder;

    public void decode() {
        SAXBuilder builder = new SAXBuilder();
        builder.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
    }

### How does this work?

#### Disable external entities

The most effective approach to prevent XXE vulnerabilities is to disable external entity processing entirely, unless it is explicitly required for specific use cases. By default, XML parsers should be configured to reject the processing of external entities. This can be achieved by setting the appropriate properties or options in your XML parser library or framework.

If external entity processing is necessary for certain scenarios, adopt a whitelisting approach to restrict the entities that can be resolved during XML parsing. Create a list of trusted external entities and disallow all others. This approach ensures that only known and safe entities are processed.
You should rely on features provided by your XML parser to restrict the external entities.

## How to fix it in SAX

### Code examples

The following code contains examples of XML parsers that have external entity processing enabled. As a result, the parsers are vulnerable to XXE attacks if an attacker can control the XML file that is processed.

#### Noncompliant code example

    import org.xml.sax.XMLReader;
    import org.xml.sax.helpers.XMLReaderFactory;

    public void decode() {
        XMLReader reader = XMLReaderFactory.createXMLReader(); // Noncompliant
    }

#### Compliant solution

Set `disallow-doctype-decl` to `true`.

    import org.xml.sax.XMLReader;
    import org.xml.sax.helpers.XMLReaderFactory;

    public void decode() {
        XMLReader reader = XMLReaderFactory.createXMLReader();
        reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
    }

### How does this work?

#### Disable external entities

The most effective approach to prevent XXE vulnerabilities is to disable external entity processing entirely, unless it is explicitly required for specific use cases. By default, XML parsers should be configured to reject the processing of external entities. This can be achieved by setting the appropriate properties or options in your XML parser library or framework.

If external entity processing is necessary for certain scenarios, adopt a whitelisting approach to restrict the entities that can be resolved during XML parsing. Create a list of trusted external entities and disallow all others. This approach ensures that only known and safe entities are processed.
You should rely on features provided by your XML parser to restrict the external entities.

## Resources

### Standards

- OWASP - Top 10 2021 Category A5 - Security Misconfiguration
- OWASP - Top 10 2017 Category A4 - XML External Entities (XXE)
- CWE - CWE-611 - Information Exposure Through XML External Entity Reference
- CWE - CWE-827 - Improper Control of Document Type Definition
- STIG Viewer - Application Security and Development: V-222608 - The application must not be vulnerable to XML-oriented attacks.