# SAML response parsing vulnerable to XXE allowing arbitrary file read

- **ID:** `security/saml-xml-external-entity-xxe`
- **Domain:** security
- **Category:** runtime_error
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

The XML parser used to process SAML assertions is configured with external entity resolution enabled, allowing an attacker to inject a malicious DOCTYPE that reads local files or performs SSRF.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Shibboleth 3.4 | active | — | — |
| OpenSAML 4.2 | active | — | — |
| SimpleSAMLphp 1.19 | active | — | — |

## Workarounds

1. **Explicitly disable external entities in the XML parser. In Java with DocumentBuilderFactory: factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);** (95% success)
   ```
   Explicitly disable external entities in the XML parser. In Java with DocumentBuilderFactory: factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
   ```
2. **Use a secure XML parser that rejects DTDs by default, such as the one provided by OWASP's XML Security library.** (90% success)
   ```
   Use a secure XML parser that rejects DTDs by default, such as the one provided by OWASP's XML Security library.
   ```
3. **Validate the SAML response against an XSD schema before parsing, and reject any document that contains a DOCTYPE declaration.** (85% success)
   ```
   Validate the SAML response against an XSD schema before parsing, and reject any document that contains a DOCTYPE declaration.
   ```

## Dead Ends

- **** — Disabling DTD processing globally may break legitimate SAML responses that use DTDs for signature validation. (40% fail)
- **** — Using a regex to filter out DOCTYPE declarations is unreliable and can be bypassed with encoding tricks. (70% fail)
- **** — Upgrading the SAML library without checking its XML parser configuration may not fix the issue if the library uses a vulnerable parser by default. (50% fail)