An XML parser misconfiguration allows an attacker to abuse external entities and access restricted resources. This attack is called:

An XML parser misconfiguration allows an attacker to abuse external entities and access restricted resources. This attack is called:

• A. XML External Entity Attack
• B. Broken Authentication
• C. Timeout Exploitation
• D. Insecure Direct Object References

Answer: (A)

This question tests XXE, XML External Entity attack. It happens when an XML parser is misconfigured to process external entity declarations, allowing an attacker to cause the parser to fetch or reveal restricted resources. By crafting XML that defines entities pointing to local files (like file:///etc/passwd) or internal network resources, the attacker can cause the parser to disclose sensitive data or reach resources that should be inaccessible. This exposure occurs because the parser is trusted to resolve those external references, so it ends up reading or relaying those resources to the attacker. Other concepts described in security literature involve different failure modes: broken authentication deals with weaknesses in verifying identities; insecure direct object references involve exposing internal object identifiers in inputs like URLs; and timeouts or related exploitation methods target performance or reliability, not the specific mechanism of an XML parser evaluating external entities.

This question tests XXE, XML External Entity attack. It happens when an XML parser is misconfigured to process external entity declarations, allowing an attacker to cause the parser to fetch or reveal restricted resources. By crafting XML that defines entities pointing to local files (like file:///etc/passwd) or internal network resources, the attacker can cause the parser to disclose sensitive data or reach resources that should be inaccessible. This exposure occurs because the parser is trusted to resolve those external references, so it ends up reading or relaying those resources to the attacker.

Other concepts described in security literature involve different failure modes: broken authentication deals with weaknesses in verifying identities; insecure direct object references involve exposing internal object identifiers in inputs like URLs; and timeouts or related exploitation methods target performance or reliability, not the specific mechanism of an XML parser evaluating external entities.