Listen to this Post
How the CVE Works
The vulnerability occurs in Allure 2’s `xunit-xml-plugin` due to insecure XML parsing. The plugin uses `DocumentBuilderFactory` without disabling Document Type Definitions (DTDs) or external entity references. When processing test result XML files, the parser expands external entities, allowing attackers to inject malicious XML payloads. This leads to arbitrary file read (file://) or Server-Side Request Forgery (SSRF) via external HTTP requests (http://`). Attackers craft a malicious XML file, place it in the test directory, and generate a report usingallure generate, triggering the XXE when the report is parsed.
<h2 style="color: blue;">DailyCVE Form</h2>
Platform: Allure 2
Version: xunit-xml-plugin
Vulnerability: XXE
Severity: Critical
Date: 2023-XX-XX
<h2 style="color: blue;">Prediction: Patch expected Q1 2024</h2>
<h2 style="color: blue;">What Undercode Say</h2>
Generate report with malicious XML allure generate /path/to/malicious_xml -o report --clean Open report to confirm exploitation allure open report Malicious XML payload (example) <!ENTITY xxe SYSTEM "file:///etc/passwd">
<h2 style="color: blue;">How Exploit</h2>
- Craft XML with external entity reference.
- Place in Allure test directory.
- Generate report to trigger XXE.
- Exfiltrate data via file read or SSRF.
<h2 style="color: blue;">Protection from this CVE</h2>
- Disable DTDs inDocumentBuilderFactory`.
– Use secure XML parsers (e.g., OWASP XXE mitigations).
– Update Allure 2 plugin post-patch.
Impact
- Arbitrary file disclosure.
- SSRF attacks.
- CI/CD pipeline compromise.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
