Xxe

XML external entity processing can read local files or reach hosts the attacker cannot, all inside a message the server parses. Configure the parser to deny it. Entities are a parser feature XML entities are a parser feature that lets a document refer to other content, and the same mechanism is what turns a small request into an expansion bomb if left unguarded. A document can define an entity that points at a local file, a network URL, or another entity, and when the parser resolves it, it reads the target and inserts its content into the document structure. That convenience is also the blast radius: a parser that is allowed to follow such references will happily read /etc/passwd over the wire, or loop forever expanding nested entities. ...