Improper Restriction of XML External Entity Reference
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-611: Improper Restriction of XML External Entity Reference |
| OWASP | A04:2017 - XML External Entities (XXE) |
| Confidence Level | Medium |
| Impact Level | High |
| Likelihood Level | Medium |
Description#
User-supplied data is being parsed as XML by the xml2json library within an Express route handler without validation. This can allow attackers to craft malicious XML input that is processed by your server.
Impact#
If exploited, attackers could read sensitive files from your server, perform server-side request forgery (SSRF), or cause denial of service. This can lead to data breaches, unauthorized access, or disruption of service, putting your application and its users at significant risk.