XXE injection
XML External Entity injection — a vulnerability where an XML parser is tricked into processing external entities the attacker smuggled in, which can read local files, perform SSRF, or cause a DoS. It arises when a parser allows dangerous XML features by default.
Mechanic: XML supports "entities" that can reference external content. An attacker who can send XML to a vulnerable parser defines an external entity pointing to, say, file:///etc/passwd or an internal URL → when the parser expands the entity it reads the file/makes the call and returns the content in the response. Consequences: reading sensitive files (password files, config, keys), SSRF (make the server call internal services/cloud metadata), and a "billion laughs" DoS (recursive entities that swell memory). Root cause: many XML libraries had external-entity processing ON by default. Defense: disable DTD/external-entity processing in the parser (the simple, definitive cure), use a simpler format (JSON) where possible, and validate input. A classic OWASP Top 10 vulnerability. Related to SSRF and insecure deserialization.