Server-Side XML Parser Security Checks

XML parsers are a frequent target for attackers looking to exploit application vulnerabilities, extract sensitive data, or trigger denial-of-service conditions. This article outlines the essential security checks and configurations web development teams must implement on server-side XML parsers to defend against threats like XML External Entity (XXE) injection, XML entity expansion attacks, and server-side request forgery (SSRF).

Disable External Entity Resolution (XXE)

The most critical check is ensuring the parser does not resolve external entities. By default, many legacy XML parsers attempt to fetch external system references (using SYSTEM or PUBLIC identifiers). Teams must explicitly disable:

  • External General Entities (external-general-entities)
  • External Parameter Entities (external-parameter-entities)
  • DTD (Document Type Definition) processing entirely (disallow-doctype-decl)

If DTD processing must remain enabled for schema validation, ensure external DTD retrieval is disabled.

Guard Against XML Entity Expansion (Billion Laughs Attack)

Attackers can cause recursive entity expansion to exhaust server memory and CPU, leading to denial of service. Enforce the following controls:

  • Set strict limits on recursion depth for nested elements and entities.
  • Limit total entity expansion thresholds using parser-specific attributes (such as FEATURE_SECURE_PROCESSING in Java or XML_PARSE_HUGE restrictions in libxml2).
  • Define maximum payload sizes at the reverse proxy or API gateway before the parser receives the document.

Turn Off XInclude Support

XInclude allows an XML document to reference and inline external files or remote resources via <xi:include> tags. Unless explicitly required by the business logic, verify that XInclude processing is explicitly turned off in the parser configuration.

Enforce Strict Schema Validation

Validate all incoming XML against a pre-compiled, locally hosted XML Schema Definition (XSD) before processing the payload in application logic.

  • Ensure the schema itself is stored securely and cannot be modified by user input.
  • Reject documents immediately if they contain unexpected tags, attributes, or invalid data types.
  • Avoid loading schemas from remote URLs at runtime.

Restrict Network and File System Privileges

Even with secure parser configurations, defense-in-depth measures limit the blast radius if a misconfiguration occurs:

  • Run the application process with the lowest possible operating system privileges so it cannot access sensitive files like /etc/passwd.
  • Implement egress network filtering to block the application server from making outbound HTTP, FTP, or DNS requests triggered by malicious XML inputs.

Keep Parsing Libraries Patched

Underlying XML libraries often have discovered vulnerabilities that bypass standard configuration flags. Maintain an automated dependency-scanning pipeline to detect and patch outdated parsing engines promptly.