Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

An enterprise web application accepts XML-based configuration files uploaded by system administrators. During a code security audit of the backend parser, an analyst discovers that the XML parser is configured to parse inline Document Type Definitions (DTDs) and resolve external entity references by default. Which of the following vulnerabilities is directly created by this parser configuration flaw?

  1. A
    Cross-Site Scripting (XSS)
  2. XML External Entity (XXE)Answer
  3. C
    Network Firewall Filtering Weakness
  4. D
    Broken Object Level Authorization (BOLA)

Answer

The XML External Entity (XXE) vulnerability allows attackers to reference external entities in XML payloads when inline DTD parsing and external entity resolution are enabled.
Enabling inline DTD processing and external entity resolution in an XML parser directly introduces an XML External Entity (XXE) vulnerability. Attackers can leverage custom entity definitions (e.g., system file paths or internal URIs) to read sensitive files from the server or conduct server-side request forgery.

Step-by-Step Solution

1
Analyze the reported software defect in the XML parsing library.
The parser permits DTD definitions and automatically fetches or resolves URI resources declared within `<!ENTITY>` tags.
Allowing external entity resolution exposes backend file systems and internal endpoints to unauthorized access.
2
Correlate the parser configuration weakness with standard application security vulnerability classes.
Processing untrusted DTD external entity declarations defines the XML External Entity (XXE) vulnerability class.
Disabling DTD processing (or disabling external entity resolution) is the primary software remediation.

Key Concept

XML External Entity (XXE) Vulnerability
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic