Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is an XXE (XML External Entity) attack?
Short answer
An XXE (XML External Entity) attack abuses parsers that resolve the external entities defined in the DOCTYPE section of an XML document, aiming to read local files on the server, to make the server send requests to services on the internal network or to put the parser out of service with nested entity expansion; it occurs in applications that accept XML and whose parser has DTD and external entity processing enabled (CWE-611). In TR7 WAF, the XML External Entity category (69 rules) of the built-in Signature & Rule Library looks for these patterns; XML bodies are additionally limited with the Xml checks of page types. The permanent measure is turning off DTD and external entity processing in the XML parser on the Backend Service (OWASP XXE Prevention).
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Configuration Menu → WAF → Signature & Rule Library; the OWASP Rules screen of the vService | Signature Category column (hidden by default); Filter → Signature Categories → XML External Entity | Listing the rules in the category; changing their state or score |
| vService → WAF Management → WAF Rules → page type → Xml tab | Block Invalid XML Contents, Block All XML Contents, XML Depth and the other Xml limits | Blocking XML bodies that cannot be parsed or are not expected; limiting the structure |
| WAF Event Logs and Global WAF Event Log | The Category column (hidden by default), the Category tab on the filter strip, the Category row in the record preview | Seeing that the request was caught by a signature in this category |
| WAF Dashboard | The Detected Attacks by Category panel | The density of the detections in the category over time |
- How TR7 parses and scans XML bodies, how requests that carry DOCTYPE are handled, and the configuration steps for SOAP services: Can I protect my SOAP / XML services; is there protection against XXE attacks?
- The category is mostly mapped to the A05:2021 (Security Misconfiguration) item of OWASP Top 10 Web.
Common Misconceptions
- "XXE affects only SOAP services." Any application that accepts an XML body or an XML-based file (such as SVG, DOCX) can be affected; the signatures of the category work not only on XML and the raw body but also on query and form values.
- "If there is a WAF, there is no need for the parser setting." The WAF catches known patterns at the request level; what closes the vulnerability is turning off DTD and external entity processing in the parser.
- "XXE is useful only for reading files." The same technique is also used to make the server send requests to addresses on the internal network (SSRF) and to consume resources with nested entity expansion.
How it is done in the documentation
