CWE-611: Improper Restriction of XML External Entity Reference

BaseDraft

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

View on MITRE
Back to CWE Lookup

Technical Details

Structure
Simple
Vulnerability Mapping
ALLOWED

Applicable To

Languages
XMLNot Language-Specific
Platforms

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine analysis methods around the CWE-611 resource boundary

MITRE identifies automated static analysis, manual source review, dynamic analysis as applicable detection approaches. Use them to inventory every XML parser and transformation entry point, then prove DTDs, external entities, external schemas, XInclude, and network-capable resolvers are disabled for untrusted documents. Require a reproducible trace from attacker influence to the unsafe behavior, record coverage gaps, and confirm suspected findings dynamically where safe; no single technique establishes complete coverage.

CWE-611: detection methods and operational guidance — MITRE CWE

Disable external XML resolution in every parser configuration

Disable DTD processing entirely where possible. Otherwise disable external general and parameter entities, external DTD and schema access, XInclude, and network-capable resolvers, while setting expansion limits. Configure each parser, transformer, validator, and unmarshaller explicitly and reject unsupported security features instead of silently continuing with unsafe defaults.

XML External Entity Prevention Cheat Sheet — OWASP Foundation

Apply lessons from CVE-2024-34102 in Adobe Commerce and Magento Open Source

NVD maps CVE-2024-34102 to CWE-611; improper restriction of XML external entities could allow remote code execution. Use the case to audit XML decoding hidden inside APIs and serialization layers, block external resolution at the parser factory, and test exploit chains beyond simple reflected file disclosure.

CVE-2024-34102 Detail — NIST National Vulnerability Database

Model external-entity exploitation with CAPEC-221

Use CAPEC-221 to cover both external-resource access and entity-expansion denial of service. Map each XML entry point to parser capabilities, resolver behavior, network egress, file privileges, and expansion limits. Require negative tests for file disclosure, server-side requests, blind callbacks, and exponential or quadratic expansion before accepting XML configuration changes.

CAPEC-221: Data Serialization External Entities Blowup — MITRE CAPEC

Exercise XML parsers with local, remote, and recursive entities

Send controlled documents containing local-file entities, remote HTTP and DNS entities, parameter entities, external schemas, XInclude, and recursive expansion to every XML-capable endpoint. Use a dedicated callback service and harmless marker files, verify no outbound resolution or file content occurs, and repeat after parser-library or framework upgrades because secure defaults vary by version.

Testing for XML Injection — OWASP Foundation

Frequently Asked Questions

What is CWE-611: Improper Restriction of XML External Entity Reference?+

CWE-611: Improper Restriction of XML External Entity Reference is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

What are the security consequences of Improper Restriction of XML External Entity Reference?+

If exploited, CWE-611 (Improper Restriction of XML External Entity Reference) it can compromise Confidentiality, Integrity and Availability, leading to outcomes such as Read Application Data, Read Files or Directories, Bypass Protection Mechanism, DoS: Resource Consumption (CPU) and DoS: Resource Consumption (Memory).

How do you prevent or mitigate Improper Restriction of XML External Entity Reference?+

Recommended mitigations for CWE-611 include: Many XML parsers and validators can be configured to disable external entity expansion.

Which programming languages are affected by Improper Restriction of XML External Entity Reference?+

CWE-611 commonly affects XML and Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Improper Restriction of XML External Entity Reference?+

MITRE documents real CVEs mapped to CWE-611, including CVE-2022-42745, CVE-2005-1306, CVE-2012-5656, CVE-2012-2239 and CVE-2012-3489. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-611 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More

Find Related CVEs

Search for vulnerabilities that exploit CWE-611

CVE vs CWE: What's the Difference?

Understanding vulnerabilities vs weaknesses

Understanding CVSS Scoring

How vulnerability severity is measured

View Full MITRE Entry

Complete technical details and references

Advertisement