CWE-611 XXE

Coverage: 8 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 8 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged XML parsing that may allow external entities or unsafe DTD features. That can cause the parser to fetch local files or make network requests during parsing.

Why it matters

XXE can expose files or internal services.

• File disclosure: read local files from the server (configs, keys).
• SSRF via XML: make requests to internal services/metadata from the parser.
• Denial of service: entity expansion attacks can exhaust CPU/memory.

Safer examples

1) Disable DTDs / external entities

Use parser settings that disable DTD processing and external entity resolution (exact API depends on language/library).

2) Prefer safer data formats

If you control the protocol, prefer JSON/protobuf over XML for untrusted inputs.

3) Use hardened XML libraries

Many ecosystems have "secure by default" XML parsers or hardening wrappers.

How SiteShadow detects it (high level)

• Recognizes XML parser usage and flags configurations that enable DTD/external entity resolution.
• Prioritizes cases where XML input is derived from untrusted sources (web requests, uploaded files, integrations).

References

• CWE-611: https://cwe.mitre.org/data/definitions/611.html

---

← Back to Vulnerability Library