CWE-611 XXE
What this means
SiteShadow flagged XML parsing that may allow external entities or unsafe DTD features. That can cause the parser to fetch local files or make network requests during parsing.
Why it matters
XXE can expose files or internal services.
- File disclosure: read local files from the server (configs, keys).
- SSRF via XML: make requests to internal services/metadata from the parser.
- Denial of service: entity expansion attacks can exhaust CPU/memory.
Safer examples
1) Disable DTDs / external entities
Use parser settings that disable DTD processing and external entity resolution (exact API depends on language/library).
2) Prefer safer data formats
If you control the protocol, prefer JSON/protobuf over XML for untrusted inputs.
3) Use hardened XML libraries
Many ecosystems have "secure by default" XML parsers or hardening wrappers.
How SiteShadow detects it (high level)
- Recognizes XML parser usage and flags configurations that enable DTD/external entity resolution.
- Prioritizes cases where XML input is derived from untrusted sources (web requests, uploaded files, integrations).
References
- CWE-611: https://cwe.mitre.org/data/definitions/611.html
---