The hook
XXE is the bug that won't die. XML standards predate the modern internet's threat model, and that lineage shows in the defaults: most XML parsers across most languages happily resolve external entities unless you explicitly tell them not to. Modern app developers don't write XML, but their dependencies do — SAML SSO flows, SOAP integrations, SVG image processing, OOXML and ODF document parsers, RSS importers, and a long tail of legacy enterprise integrations. The bug returns each time someone wires a parser into a new code path without remembering to disable DOCTYPE processing. The fix is one config line. The exploitation is one curl command.
How it works
XXE issues appear when XML parsers accept untrusted external entity behavior. Depending on parser configuration, this can expose internal files, metadata services, or internal network endpoints.
The blast radius
Local file read at the privilege of the web server process — application config, secrets files, source code, /etc/passwd, environment variables. SSRF into the cloud metadata service hands over IAM credentials. DoS via billion-laughs trivially knocks the parser process over. On parsers that support PHP filter wrappers or expect://, the bug grades up to remote code execution. SAML and SOAP integrations are particularly painful because the XXE vector lives in the trusted authentication path.
// what fixvibe checks
What FixVibe checks
FixVibe checks this class with verified-domain active testing that is bounded, non-destructive, and evidence-driven. Public reports describe the affected surface and remediation. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Ironclad defenses
Disable external entity resolution at the parser level. Every major XML parser has the flag: in Java, `factory.setFeature('http://apache.org/xml/features/disallow-doctype-decl', true)`; in libxml-based parsers, `XML_PARSE_NOENT` set to false plus `XML_PARSE_NONET`; in Python's lxml, use `defusedxml` instead of the stdlib parser; in .NET, `XmlReaderSettings { DtdProcessing = DtdProcessing.Prohibit }`. Better still, use JSON wherever you have the choice — most modern apps don't actually need XML, they inherited it from a legacy integration. For SAML and SOAP, use a battle-tested library that already has XXE defenses baked in (don't roll your own XML parsing for these). As a defense-in-depth layer, restrict the parser process's network egress and filesystem access — XXE that can only reach the public internet is significantly less useful to an attacker than XXE with metadata-service access.