XML external entity (XXE) injection via unsafe parser configuration

ID

vbnet.inject.xml_entity_injection

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Inject

Language

VB.NET

Description

XML parser configured to resolve external entities or Document Type Definitions (DtdProcessing.Parse, an XmlUrlResolver, or ProhibitDtd = False). Parsing untrusted XML with this configuration enables XML External Entity (XXE) injection, leading to file disclosure or SSRF. Set DtdProcessing to Prohibit/Ignore and leave XmlResolver as Nothing.

Rationale

XML parser configured to resolve external entities or Document Type Definitions (DtdProcessing.Parse, an XmlUrlResolver, or ProhibitDtd = False). Parsing untrusted XML with this configuration enables XML External Entity (XXE) injection, leading to file disclosure or SSRF. Set DtdProcessing to Prohibit/Ignore and leave XmlResolver as Nothing.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub DtdParseAssignment()
    Dim settings As New XmlReaderSettings()
    ' VULNERABLE: XML external entity (XXE) injection via unsafe parser configuration
    settings.DtdProcessing = DtdProcessing.Parse
    Dim reader = XmlReader.Create("data.xml", settings)
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References