flawopen.com/XXE/.NET XmlReader

Is .NET's XmlReader safe from XXE?

CWE-611: XML External Entity ReferenceReference page
Short answer

On modern .NET, yes by default — XmlReader prohibits DTD processing unless you enable it. The risk lives in legacy .NET Framework code and in the other XML types: older XmlDocument and XmlTextReader shipped with an XmlResolver that resolved external entities.

VULNERABLE — legacy patterns
// .NET Framework, older versions:
// XmlDocument had a non-null resolver
var doc = new XmlDocument();
doc.Load(untrustedStream);

// XmlTextReader likewise
var rdr = new XmlTextReader(stream);
while (rdr.Read()) { }

// Explicitly re-enabling it is always
// dangerous with untrusted input:
var settings = new XmlReaderSettings {
    DtdProcessing = DtdProcessing.Parse,
    XmlResolver   = new XmlUrlResolver()
};
FIXED
var settings = new XmlReaderSettings {
    // Reject documents with a DTD
    DtdProcessing = DtdProcessing.Prohibit,
    // No external resource resolution
    XmlResolver   = null,
    MaxCharactersFromEntities = 1024,
};

using var reader =
    XmlReader.Create(stream, settings);

// If you must use XmlDocument, null
// the resolver explicitly:
var doc = new XmlDocument {
    XmlResolver = null
};
doc.Load(reader);

Which type you use decides your exposure

.NET has several XML APIs whose defaults have differed, and whose defaults have also changed across framework versions. The practical summary:

Because the answer depends on both the type and the target framework, the durable approach is to configure XmlReaderSettings explicitly at every boundary where untrusted XML enters, rather than relying on the default being correct wherever the code is eventually compiled.

FAQ

What does MaxCharactersFromEntities do?

It caps the total characters produced by entity expansion, which limits billion-laughs style denial of service in cases where a DTD is permitted. It is a useful secondary control; prohibiting DTD processing outright is stronger.

Is DtdProcessing.Ignore as good as Prohibit?

Ignore skips the DTD silently; Prohibit throws. Prefer Prohibit for untrusted input, because failing loudly surfaces unexpected documents rather than processing them in a partially-understood state.

Does this affect SOAP, SAML or Office file parsing?

Yes. Anything that parses XML supplied by another party — web service payloads, SAML assertions, OOXML documents, configuration uploads — needs the same hardening at the point the reader is constructed.

References