XML External Entity attacks have been identified as an OWASP top 10 web application vulnerability. Whilst there seems to be extensive information on what an XML external entity attack is and how it can be prevented, I have not been able to find any detail on how it can be detected.
The syntax below is an example of an external entity. I understand that if application or web server logs include the detail of the XML body of incoming requests then there should be an ability to detect this attack by configuring alerting rules for strings that contain the words ENTITY and SYSTEM
Is this the most appropriate/efficient way to detect? Any other thoughts or experience with detecting this attack?
<!ENTITY entity-name SYSTEM "URL/URI" >