The Ravens’ import feature parses an XML document you send, and the XML parser allows external entities, so you can define an entity that reads a file from the server such as /etc/passwd.
The Ravens feed import parses an XML document you send and shows what it read. The parser allows external entities, so you can define an entity that reads a file from the server and have it shown in the document body.
Define an external entity that reads /etc/passwd and make the document render its content.
You read /etc/passwd through an external XML entity.
Why the solution worked
This is XXE, XML external entities. The XML parser reads the external entity from a SYSTEM URL and puts its content into the document, so the attacker reads server files or reaches internal services. The fix: disable external entities and DTDs in the XML parser (most parsers have a disallow-doctype option or secure processing), or use a simpler format like JSON that has no entities at all.
The root cause
The parser processes external entity definitions in the DOCTYPE and resolves them from the filesystem. The root is leaving a dangerous legacy XML feature enabled.
How the code is fixed
Disable DTDs and external entities, or drop XML for JSON. Entities are a feature you rarely need.
Vulnerable code
const doc = new DOMParser().parseFromString(xml, 'text/xml'); // entities resolved
Safe code
// Disable DTDs and external entities (names vary by library).
const parser = new XMLParser({ resolveExternalEntities: false, processEntities: false });
const doc = parser.parse(xml);
// Or: accept JSON instead of XML.
Impact in the real world
XXE reads sensitive server files and can turn into SSRF or denial of service; it has hit major XML-import systems.
How defenders detect it
Defenders disable external entities and DOCTYPE in the XML parser and alert on incoming documents containing DOCTYPE or ENTITY.
