XXE is an abbreviation of XML External Entity. As an attack, it takes advantage of a flaw in an application's XML parser configuration to perform a number of malicious actions, including exposing the contents of protected files, or causing the exponential use of memory, resulting in a DoS attack.
XML, like JSON, comprises a big part of the data transfer that powers the modern internet. As a system for encoding documents in both human and machine-readable ways, XML is common in tech stacks of a certain age, and persists in older API architectures such as Simple Object Access Protocol (SOAP), even though web applications rely more and more on JSON as a common standard. In 2017, OWASP named XXE as number four on their list of the top ten web vulnerabilities—it wasn't included in the list in the previous survey in 2014.
The nature of...
