XML External Entity
High Web Application Scanning Plugin ID 98113
Synopsis
XML External Entity
Description
An XML External Entity attack is a type of attack against an application that
parses XML input.
This attack occurs when XML input containing a reference to an external entity is
processed by a weakly configured XML parser.
This attack may lead to the disclosure of confidential data, denial of service,
port scanning from the perspective of the machine where the parser is located,
and other system impacts.
Solution
Since the whole XML document is communicated from an untrusted client, it's not usually possible to selectively validate or escape tainted data within the system identifier in the DTD.
Therefore, the XML processor should be configured to use a local static DTD and disallow any declared DTD included in the XML document.