{"id":479728,"date":"2023-08-09T10:43:58","date_gmt":"2023-08-09T10:43:58","guid":{"rendered":""},"modified":"2023-09-05T11:19:26","modified_gmt":"2023-09-05T11:19:26","slug":"xml-external-entity","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/vn\/wiki\/xml-external-entity\/","title":{"rendered":"Th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i XML"},"content":{"rendered":"<h2>Gi\u1edbi thi\u1ec7u<\/h2>\n<p>Th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i XML (XXE) l\u00e0 m\u1ed9t l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn c\u00e1c \u1ee9ng d\u1ee5ng ph\u00e2n t\u00edch c\u00fa ph\u00e1p d\u1eef li\u1ec7u XML. L\u1ed7 h\u1ed5ng n\u00e0y c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn vi\u1ec7c ti\u1ebft l\u1ed9 th\u00f4ng tin nh\u1ea1y c\u1ea3m, t\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5 v\u00e0 th\u1eadm ch\u00ed th\u1ef1c thi m\u00e3 t\u1eeb xa. Trong b\u00e0i vi\u1ebft n\u00e0y, ch\u00fang t\u00f4i s\u1ebd \u0111i s\u00e2u v\u00e0o l\u1ecbch s\u1eed, ho\u1ea1t \u0111\u1ed9ng, lo\u1ea1i, chi\u1ebfn l\u01b0\u1ee3c gi\u1ea3m nh\u1eb9 v\u00e0 tri\u1ec3n v\u1ecdng trong t\u01b0\u01a1ng lai c\u1ee7a c\u00e1c Th\u1ef1c th\u1ec3 B\u00ean ngo\u00e0i XML. Ngo\u00e0i ra, ch\u00fang ta s\u1ebd kh\u00e1m ph\u00e1 m\u1ed1i quan h\u1ec7 gi\u1eefa m\u00e1y ch\u1ee7 proxy v\u00e0 l\u1ed7 h\u1ed5ng XXE.<\/p>\n<h2>L\u1ecbch s\u1eed c\u1ee7a th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i XML<\/h2>\n<p>Kh\u00e1i ni\u1ec7m Th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i XML l\u1ea7n \u0111\u1ea7u ti\u00ean \u0111\u01b0\u1ee3c World Wide Web Consortium (W3C) gi\u1edbi thi\u1ec7u trong \u0111\u1eb7c t\u1ea3 XML 1.0 v\u00e0o n\u0103m 1998. T\u00ednh n\u0103ng n\u00e0y \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 cho ph\u00e9p \u0111\u01b0a c\u00e1c t\u00e0i nguy\u00ean b\u00ean ngo\u00e0i v\u00e0o t\u00e0i li\u1ec7u XML, cho ph\u00e9p c\u00e1c nh\u00e0 ph\u00e1t tri\u1ec3n s\u1eed d\u1ee5ng l\u1ea1i d\u1eef li\u1ec7u v\u00e0 qu\u1ea3n l\u00fd n\u1ed9i dung hi\u1ec7u qu\u1ea3 h\u01a1n. Tuy nhi\u00ean, theo th\u1eddi gian, nh\u1eefng lo ng\u1ea1i v\u1ec1 b\u1ea3o m\u1eadt \u0111\u00e3 xu\u1ea5t hi\u1ec7n do kh\u1ea3 n\u0103ng s\u1eed d\u1ee5ng sai ch\u1ee9c n\u0103ng n\u00e0y.<\/p>\n<h2>Th\u00f4ng tin chi ti\u1ebft v\u1ec1 th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i XML<\/h2>\n<p>L\u1ed7 h\u1ed5ng Th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i XML ph\u00e1t sinh khi k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e1nh l\u1eeba tr\u00ecnh ph\u00e2n t\u00edch c\u00fa ph\u00e1p XML \u0111\u1ec3 x\u1eed l\u00fd c\u00e1c th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i c\u00f3 ch\u1ee9a t\u1ea3i tr\u1ecdng \u0111\u1ed9c h\u1ea1i. C\u00e1c t\u1ea3i tr\u1ecdng n\u00e0y c\u00f3 th\u1ec3 khai th\u00e1c l\u1ed7 h\u1ed5ng \u0111\u1ec3 truy c\u1eadp t\u1ec7p, t\u00e0i nguy\u00ean ho\u1eb7c th\u1eadm ch\u00ed th\u1ef1c hi\u1ec7n c\u00e1c h\u00e0nh \u0111\u1ed9ng t\u00f9y \u00fd tr\u00ean m\u00e1y ch\u1ee7.<\/p>\n<h2>C\u1ea5u tr\u00fac v\u00e0 ch\u1ee9c n\u0103ng b\u00ean trong<\/h2>\n<p>C\u1ed1t l\u00f5i c\u1ee7a Th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i XML l\u00e0 vi\u1ec7c s\u1eed d\u1ee5ng \u0110\u1ecbnh ngh\u0129a lo\u1ea1i t\u00e0i li\u1ec7u (DTD) ho\u1eb7c khai b\u00e1o th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i. Khi tr\u00ecnh ph\u00e2n t\u00edch c\u00fa ph\u00e1p XML g\u1eb7p m\u1ed9t tham chi\u1ebfu th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i, n\u00f3 s\u1ebd t\u00ecm n\u1ea1p t\u00e0i nguy\u00ean \u0111\u00e3 ch\u1ec9 \u0111\u1ecbnh v\u00e0 k\u1ebft h\u1ee3p n\u1ed9i dung c\u1ee7a n\u00f3 v\u00e0o t\u00e0i li\u1ec7u XML. Qu\u00e1 tr\u00ecnh n\u00e0y, tuy m\u1ea1nh m\u1ebd nh\u01b0ng c\u0169ng khi\u1ebfn c\u00e1c \u1ee9ng d\u1ee5ng c\u00f3 nguy c\u01a1 b\u1ecb t\u1ea5n c\u00f4ng.<\/p>\n<h2>C\u00e1c t\u00ednh n\u0103ng ch\u00ednh c\u1ee7a Th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i XML<\/h2>\n<ul>\n<li>Kh\u1ea3 n\u0103ng s\u1eed d\u1ee5ng l\u1ea1i d\u1eef li\u1ec7u: XXE cho ph\u00e9p d\u1eef li\u1ec7u \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng l\u1ea1i tr\u00ean nhi\u1ec1u t\u00e0i li\u1ec7u.<\/li>\n<li>T\u0103ng hi\u1ec7u qu\u1ea3: C\u00e1c th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i h\u1ee3p l\u00fd h\u00f3a vi\u1ec7c qu\u1ea3n l\u00fd n\u1ed9i dung.<\/li>\n<li>R\u1ee7i ro b\u1ea3o m\u1eadt: XXE c\u00f3 th\u1ec3 b\u1ecb khai th\u00e1c cho m\u1ee5c \u0111\u00edch x\u1ea5u.<\/li>\n<\/ul>\n<h2>C\u00e1c lo\u1ea1i th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i XML<\/h2>\n<table>\n<thead>\n<tr>\n<th>Ki\u1ec3u<\/th>\n<th>S\u1ef1 mi\u00eau t\u1ea3<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Th\u1ef1c th\u1ec3 n\u1ed9i b\u1ed9<\/td>\n<td>\u0110\u1ec1 c\u1eadp \u0111\u1ebfn d\u1eef li\u1ec7u \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh trong DTD v\u00e0 \u0111\u01b0\u1ee3c \u0111\u01b0a tr\u1ef1c ti\u1ebfp v\u00e0o t\u00e0i li\u1ec7u XML.<\/td>\n<\/tr>\n<tr>\n<td>Th\u1ef1c th\u1ec3 \u0111\u01b0\u1ee3c ph\u00e2n t\u00edch c\u00fa ph\u00e1p b\u00ean ngo\u00e0i<\/td>\n<td>Li\u00ean quan \u0111\u1ebfn tham chi\u1ebfu \u0111\u1ebfn m\u1ed9t th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i trong DTD, v\u1edbi n\u1ed9i dung \u0111\u01b0\u1ee3c b\u1ed9 x\u1eed l\u00fd XML ph\u00e2n t\u00edch c\u00fa ph\u00e1p.<\/td>\n<\/tr>\n<tr>\n<td>Th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i ch\u01b0a \u0111\u01b0\u1ee3c ph\u00e2n t\u00edch c\u00fa ph\u00e1p<\/td>\n<td>Tr\u1ecf t\u1edbi d\u1eef li\u1ec7u nh\u1ecb ph\u00e2n b\u00ean ngo\u00e0i ho\u1eb7c d\u1eef li\u1ec7u kh\u00f4ng \u0111\u01b0\u1ee3c ph\u00e2n t\u00edch c\u00fa ph\u00e1p, kh\u00f4ng \u0111\u01b0\u1ee3c tr\u00ecnh ph\u00e2n t\u00edch c\u00fa ph\u00e1p XML x\u1eed l\u00fd tr\u1ef1c ti\u1ebfp.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>S\u1eed d\u1ee5ng, th\u00e1ch th\u1ee9c v\u00e0 gi\u1ea3i ph\u00e1p<\/h2>\n<h3>S\u1eed d\u1ee5ng<\/h3>\n<ul>\n<li>XXE c\u00f3 th\u1ec3 b\u1ecb khai th\u00e1c \u0111\u1ec3 tr\u00edch xu\u1ea5t d\u1eef li\u1ec7u t\u1eeb c\u00e1c t\u1ec7p n\u1ed9i b\u1ed9.<\/li>\n<li>C\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng t\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5 (DoS) c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c ph\u00e1t \u0111\u1ed9ng do l\u00e0m qu\u00e1 t\u1ea3i t\u00e0i nguy\u00ean.<\/li>\n<\/ul>\n<h3>Nh\u1eefng th\u00e1ch th\u1ee9c v\u00e0 gi\u1ea3i ph\u00e1p<\/h3>\n<ul>\n<li><strong>X\u00e1c th\u1ef1c \u0111\u1ea7u v\u00e0o<\/strong>: X\u00e1c th\u1ef1c th\u00f4ng tin \u0111\u1ea7u v\u00e0o c\u1ee7a ng\u01b0\u1eddi d\u00f9ng \u0111\u1ec3 ng\u0103n ch\u1eb7n t\u1ea3i tr\u1ecdng \u0111\u1ed9c h\u1ea1i.<\/li>\n<li><strong>T\u1eaft DTD<\/strong>: \u0110\u1ecbnh c\u1ea5u h\u00ecnh tr\u00ecnh ph\u00e2n t\u00edch c\u00fa ph\u00e1p \u0111\u1ec3 b\u1ecf qua DTD, gi\u1ea3m r\u1ee7i ro XXE.<\/li>\n<li><strong>T\u01b0\u1eddng l\u1eeda v\u00e0 proxy<\/strong>: S\u1eed d\u1ee5ng t\u01b0\u1eddng l\u1eeda v\u00e0 proxy \u0111\u1ec3 l\u1ecdc l\u01b0u l\u01b0\u1ee3ng XML \u0111\u1ebfn.<\/li>\n<\/ul>\n<h2>So s\u00e1nh v\u00e0 \u0111\u1eb7c \u0111i\u1ec3m ch\u00ednh<\/h2>\n<table>\n<thead>\n<tr>\n<th>T\u00ednh n\u0103ng<\/th>\n<th>Th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i XML (XXE)<\/th>\n<th>T\u1eadp l\u1ec7nh ch\u00e9o trang (XSS)<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Lo\u1ea1i l\u1ed7 h\u1ed5ng<\/td>\n<td>Ph\u00e2n t\u00edch d\u1eef li\u1ec7u XML<\/td>\n<td>\u0110\u01b0a c\u00e1c t\u1eadp l\u1ec7nh \u0111\u1ed9c h\u1ea1i v\u00e0o trang web<\/td>\n<\/tr>\n<tr>\n<td>H\u1eadu qu\u1ea3 khai th\u00e1c<\/td>\n<td>Ti\u1ebfp x\u00fac d\u1eef li\u1ec7u, DoS, th\u1ef1c thi m\u00e3 t\u1eeb xa<\/td>\n<td>Th\u1ef1c thi t\u1eadp l\u1ec7nh tr\u00e1i ph\u00e9p<\/td>\n<\/tr>\n<tr>\n<td>Vect\u01a1 t\u1ea5n c\u00f4ng<\/td>\n<td>Tr\u00ecnh ph\u00e2n t\u00edch c\u00fa ph\u00e1p XML, tr\u01b0\u1eddng \u0111\u1ea7u v\u00e0o<\/td>\n<td>Bi\u1ec3u m\u1eabu web, URL<\/td>\n<\/tr>\n<tr>\n<td>Ph\u00f2ng ng\u1eeba<\/td>\n<td>X\u00e1c th\u1ef1c \u0111\u1ea7u v\u00e0o, v\u00f4 hi\u1ec7u h\u00f3a DTD<\/td>\n<td>M\u00e3 h\u00f3a \u0111\u1ea7u ra, x\u00e1c th\u1ef1c \u0111\u1ea7u v\u00e0o<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Quan \u0111i\u1ec3m v\u00e0 c\u00f4ng ngh\u1ec7 t\u01b0\u01a1ng lai<\/h2>\n<p>Khi c\u00f4ng ngh\u1ec7 XML ph\u00e1t tri\u1ec3n, c\u00e1c n\u1ed7 l\u1ef1c \u0111ang \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n nh\u1eb1m t\u0103ng c\u01b0\u1eddng c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt v\u00e0 gi\u1ea3m thi\u1ec3u c\u00e1c l\u1ed7 h\u1ed5ng XXE. C\u00e1c tr\u00ecnh ph\u00e2n t\u00edch c\u00fa ph\u00e1p XML m\u1edbi \u0111ang \u0111\u01b0\u1ee3c ph\u00e1t tri\u1ec3n v\u1edbi c\u00e1c t\u00ednh n\u0103ng b\u1ea3o m\u1eadt \u0111\u01b0\u1ee3c c\u1ea3i thi\u1ec7n v\u00e0 c\u1ed9ng \u0111\u1ed3ng XML ti\u1ebfp t\u1ee5c c\u1ea3i ti\u1ebfn c\u00e1c ph\u01b0\u01a1ng ph\u00e1p hay nh\u1ea5t \u0111\u1ec3 x\u1eed l\u00fd XML an to\u00e0n.<\/p>\n<h2>M\u00e1y ch\u1ee7 proxy v\u00e0 th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i XML<\/h2>\n<p>C\u00e1c m\u00e1y ch\u1ee7 proxy, gi\u1ed1ng nh\u01b0 c\u00e1c m\u00e1y ch\u1ee7 do OneProxy (oneproxy.pro) cung c\u1ea5p, c\u00f3 th\u1ec3 \u0111\u00f3ng m\u1ed9t vai tr\u00f2 quan tr\u1ecdng trong vi\u1ec7c gi\u1ea3m thi\u1ec3u c\u00e1c l\u1ed7 h\u1ed5ng XXE. B\u1eb1ng c\u00e1ch \u0111\u00f3ng vai tr\u00f2 trung gian gi\u1eefa m\u00e1y kh\u00e1ch v\u00e0 m\u00e1y ch\u1ee7, m\u00e1y ch\u1ee7 proxy c\u00f3 th\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt nh\u01b0 x\u00e1c th\u1ef1c \u0111\u1ea7u v\u00e0o, d\u1ecdn d\u1eb9p d\u1eef li\u1ec7u v\u00e0 v\u00f4 hi\u1ec7u h\u00f3a DTD tr\u01b0\u1edbc khi chuy\u1ec3n c\u00e1c y\u00eau c\u1ea7u XML \u0111\u1ebfn m\u00e1y ch\u1ee7 m\u1ee5c ti\u00eau. \u0110i\u1ec1u n\u00e0y b\u1ed5 sung th\u00eam m\u1ed9t l\u1edbp b\u1ea3o v\u1ec7 ch\u1ed1ng l\u1ea1i c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng XXE.<\/p>\n<h2>Li\u00ean k\u1ebft li\u00ean quan<\/h2>\n<p>\u0110\u1ec3 bi\u1ebft th\u00eam th\u00f4ng tin v\u1ec1 c\u00e1c Th\u1ef1c th\u1ec3 B\u00ean ngo\u00e0i XML v\u00e0 \u00fd ngh\u0129a b\u1ea3o m\u1eadt c\u1ee7a ch\u00fang, vui l\u00f2ng tham kh\u1ea3o c\u00e1c t\u00e0i nguy\u00ean sau:<\/p>\n<ul>\n<li><a href=\"https:\/\/www.w3.org\/TR\/REC-xml\/\" target=\"_new\" rel=\"noopener nofollow\">\u0110\u1eb7c t\u1ea3 W3C XML 1.0<\/a><\/li>\n<li><a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/XML_External_Entity_Prevention_Cheat_Sheet.html\" target=\"_new\" rel=\"noopener nofollow\">B\u1ea3ng cheat ph\u00f2ng ch\u1ed1ng OWASP XXE<\/a><\/li>\n<li><a href=\"https:\/\/csrc.nist.gov\/publications\/detail\/sp\/800-95\/final\" target=\"_new\" rel=\"noopener nofollow\">H\u01b0\u1edbng d\u1eabn c\u1ee7a NIST v\u1ec1 b\u1ea3o m\u1eadt XML<\/a><\/li>\n<li><a href=\"https:\/\/oneproxy.pro\/vn\/\" target=\"_new\" rel=\"noopener\">OneProxy \u2013 B\u1ea3o m\u1eadt l\u01b0u l\u01b0\u1ee3ng XML c\u1ee7a b\u1ea1n<\/a><\/li>\n<\/ul>\n<p>T\u00f3m l\u1ea1i, vi\u1ec7c hi\u1ec3u c\u00e1c l\u1ed7 h\u1ed5ng c\u1ee7a Th\u1ef1c th\u1ec3 b\u00ean ngo\u00e0i XML l\u00e0 r\u1ea5t quan tr\u1ecdng \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o t\u00ednh b\u1ea3o m\u1eadt c\u1ee7a c\u00e1c \u1ee9ng d\u1ee5ng d\u1ef1a tr\u00ean XML. Khi c\u00f4ng ngh\u1ec7 ph\u00e1t tri\u1ec3n, tr\u1ecdng t\u00e2m v\u00e0o vi\u1ec7c t\u0103ng c\u01b0\u1eddng b\u1ea3o m\u1eadt x\u1eed l\u00fd XML ti\u1ebfp t\u1ee5c ph\u00e1t tri\u1ec3n v\u00e0 s\u1ef1 h\u1ee3p t\u00e1c gi\u1eefa c\u00e1c chuy\u00ean gia b\u1ea3o m\u1eadt, nh\u00e0 ph\u00e1t tri\u1ec3n v\u00e0 nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 proxy nh\u01b0 OneProxy c\u00f3 th\u1ec3 \u0111\u00f3ng g\u00f3p \u0111\u00e1ng k\u1ec3 v\u00e0o b\u1ed1i c\u1ea3nh k\u1ef9 thu\u1eadt s\u1ed1 an to\u00e0n h\u01a1n.<\/p>","protected":false},"featured_media":479729,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-479728","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>XML External Entity (XXE) Vulnerability: Exploring Risks and Mitigation<\/mark>","faq_items":[{"question":"What is an XML External Entity (XXE) vulnerability?","answer":"<p>An XML External Entity (XXE) vulnerability is a security flaw that affects applications processing XML data. It occurs when an attacker manipulates an XML parser to include external entities containing malicious content. This can lead to unauthorized access, data exposure, denial of service, and even remote code execution.<\/p>"},{"question":"How did the concept of XML External Entity originate?","answer":"<p>The concept of XML External Entity was introduced in the XML 1.0 specification by the W3C in 1998. It aimed to enable the reuse of data across XML documents, but over time, security concerns emerged due to potential misuse.<\/p>"},{"question":"What are the key characteristics of XXE vulnerabilities?","answer":"<p>XXE vulnerabilities offer data reusability, increased content management efficiency, but also present a security risk. They can be exploited to extract internal data, launch DoS attacks, and execute remote code.<\/p>"},{"question":"What are the types of XML External Entity?","answer":"<p>There are three types of XML External Entities:<\/p><ol><li><strong>Internal Entity:<\/strong> Data defined within the DTD and included directly in the XML document.<\/li><li><strong>External Parsed Entity:<\/strong> References an external entity in the DTD, with its content parsed by the XML processor.<\/li><li><strong>External Unparsed Entity:<\/strong> Points to external binary or non-parsed data, not processed directly by the XML parser.<\/li><\/ol>"},{"question":"How can XXE vulnerabilities be mitigated?","answer":"<p>To mitigate XXE vulnerabilities, consider these solutions:<\/p><ul><li><strong>Input Validation:<\/strong> Thoroughly validate user input to prevent malicious payloads.<\/li><li><strong>Disable DTDs:<\/strong> Configure parsers to ignore DTDs, reducing XXE risk.<\/li><li><strong>Firewalls and Proxies:<\/strong> Use firewalls and proxy servers to filter incoming XML traffic.<\/li><\/ul>"},{"question":"How do proxy servers like OneProxy help with XXE vulnerabilities?","answer":"<p>Proxy servers like OneProxy act as intermediaries between clients and servers, adding an extra layer of protection. They can implement security measures such as input validation, data sanitization, and disabling DTDs before passing XML requests to the target server. This enhances the security of XML traffic.<\/p>"},{"question":"What are the future perspectives of XXE vulnerabilities?","answer":"<p>As XML technologies advance, efforts to enhance security measures against XXE vulnerabilities continue. New XML parsers are being developed with improved security features, and best practices for secure XML processing are refined to create a safer digital environment.<\/p>"},{"question":"Where can I find more information on XXE vulnerabilities?","answer":"<p>For more information on XML External Entity vulnerabilities and their security implications, refer to these resources:<\/p><ul><li><a href=\"https:\/\/www.w3.org\/TR\/REC-xml\/\" target=\"_new\">W3C XML 1.0 Specification<\/a><\/li><li><a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/XML_External_Entity_Prevention_Cheat_Sheet.html\" target=\"_new\">OWASP XXE Prevention Cheat Sheet<\/a><\/li><li><a href=\"https:\/\/csrc.nist.gov\/publications\/detail\/sp\/800-95\/final\" target=\"_new\">NIST Guidelines on XML Security<\/a><\/li><li><a href=\"https:\/\/oneproxy.pro\/\" target=\"_new\">OneProxy - Secure Your XML Traffic<\/a><\/li><\/ul>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/479728","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/479728\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media\/479729"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media?parent=479728"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}