Chapter 5: XML External Entities

eXtensible Markup Language (XML) is a standard markup language that's used to define data. XML is also a format that an ASP.NET Core web application can use to parse information. To achieve this, a developer can use any number of .NET XML parsers readily available in the framework.

XML being a source of input is likely to be prone to malicious data injection. A feature called XML External Entity (XXE) allows XML to define a custom entity using a URL or file path. This ability to represent external entities in XML can be abused or exploited. Unrestricted external entity references can allow attackers to send sensitive information and files outside the applications' trusted domains and into the perpetrator-controlled server. The existence of this vulnerability can lead to Denial-of-Service (DoS) attacks, making the whole application inaccessible because of flooded requests, or file inclusion attacks, where an adversary can gain unauthorized...