A4 – Using XML external entities securely

XML external entity (XXE) attacks have gained popularity in the last few years, so that they now appear in the fourth position of the OWASP Top 10 2017. XML entity-related vulnerabilities are used by attackers mainly to retrieve information from the target system and remotely execute code or system commands (XXE Injection), or to cause the interruption of services (XXE Expansion).

In this recipe, we will provide some suggestions on what to do when building a web application to prevent including vulnerabilities in the processing of XML external entities.

How to do it...

1. If possible, avoid the use of XML and prefer less complex formats, such as JSON.
2. If XML use is mandatory,...