An XML parsing misconfiguration can allow an attacker to read internal files or resources. This vulnerability is called:

An XML parsing misconfiguration can allow an attacker to read internal files or resources. This vulnerability is called:

• A. XML External Entity Attack
• B. Broken Authentication
• C. Timeout Exploitation
• D. Insecure Direct Object References

Answer: (A)

XML External Entity processing is the concept here. When an XML parser is allowed to resolve external entities defined in a document type or DTD, an attacker can supply an XML payload that references a local file or an internal resource. The parser, following the external entity, fetches and includes that content, potentially revealing sensitive files or internal data. This misconfiguration lets an attacker read internal resources simply by submitting crafted XML. This is different from broken authentication, which is about validating who a user is, not about how XML is parsed. It’s also not a timeout exploitation, which would involve causing a service to fail or become unavailable due to timing issues. And it isn’t insecure direct object references, which involve unvalidated or unauthorized access to internal objects via direct links, independent of XML parsing behavior.

XML External Entity processing is the concept here. When an XML parser is allowed to resolve external entities defined in a document type or DTD, an attacker can supply an XML payload that references a local file or an internal resource. The parser, following the external entity, fetches and includes that content, potentially revealing sensitive files or internal data. This misconfiguration lets an attacker read internal resources simply by submitting crafted XML.

This is different from broken authentication, which is about validating who a user is, not about how XML is parsed. It’s also not a timeout exploitation, which would involve causing a service to fail or become unavailable due to timing issues. And it isn’t insecure direct object references, which involve unvalidated or unauthorized access to internal objects via direct links, independent of XML parsing behavior.