What is XXE?
XXE, short for XML external entity injection, is an attack against applications that parse XML submitted by a user. XML lets a document define entities, shorthand values the parser expands, and it allows external entities that pull their value from an outside source such as a file or a URL. When an application accepts untrusted XML and its parser resolves external entities, an attacker can make the parser fetch things it was never meant to.
How the attack works
The attacker submits XML whose document type definition declares an external entity pointing at a target, then references that entity somewhere the application echoes back. A common payload declares an entity with a SYSTEM identifier aimed at a local file; when the parser expands it, the file's contents are read into the response and returned to the attacker. The same technique aimed at an internal URL turns the server into a request tool, which is why XXE is a common route to server-side request forgery against metadata services and internal hosts. Applications that accept a SOAP request, a document upload or any other XML input are the exposure.
What an attacker gains
XXE can disclose configuration files and credentials from the server's own filesystem, probe and reach internal services behind the firewall, and in some parsers cause denial of service through nested entities that expand exponentially, the billion laughs attack. Because it rides on a data format many APIs accept without a second thought, it often reaches places other injection attacks cannot.
How to defend against it
The direct and reliable fix is to disable external entity and document type definition processing in the XML parser, which most libraries support with a configuration flag. Where XML features are not needed, prefer a simpler data format or a hardened parser configuration. Input validation and allow-listing help as layers, but the authoritative control is turning off the parser behavior the attack depends on.
XXE on the CompTIA Security+ exam
XXE is one of the application-attack indicators under SY0-801 objective 2.5. The scenario marker is untrusted XML, often an upload or an API request, that declares a DOCTYPE with a SYSTEM entity and ends up reading a server file or reaching an internal address. The exam-correct fix is to disable external entities and DTD processing. Watch for the overlap with server-side request forgery, since a malicious entity can make the parser fetch an internal URL.