Listen to this Post
The XXE vulnerability in Bio-Formats arises from insecure XML parsing in the Leica Microsystems metadata component, specifically for XLEF files. Versions up to 8.3.0 use a DocumentBuilderFactory that does not restrict external entity expansion or DTD loading. When processing an XML metadata file, the parser resolves external entities defined within the document. An attacker can craft a malicious XLEF file containing entity references with SYSTEM identifiers pointing to external resources. For example, an entity may reference a local file path like file:///etc/passwd or a remote URL. During parsing, the software attempts to fetch these resources, leading to server-side request forgery (SSRF) by making outbound network requests to internal systems. It can also read local files accessible to the application process, potentially exposing sensitive data. Additionally, the parser may load external DTDs from attacker-controlled servers, which can be used to escalate attacks or cause denial of service through billion laughs-style entity expansion. This occurs because features like FEATURE_SECURE_PROCESSING are not enabled, and DOCTYPE declarations are not disabled. The vulnerability requires the application to parse a crafted file, which could happen via user upload or automated processing in bioinformatics pipelines. The moderate severity reflects the need for user interaction and potential network restrictions, but in permissive environments, impact can be significant.
Platform: Bio-Formats
Version: up to 8.3.0
Vulnerability: XML External Entity
Severity: Moderate
date: Jan 7, 2026
Prediction: Patch expected soon
What Undercode Say:
Analytics:
Bash commands:
echo ‘ ]>
curl -F “[email protected]” http://localhost:8080/parse
Codes:
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature(“http://xml.org/sax/features/external-general-entities”, false);
dbf.setFeature(“http://xml.org/sax/features/external-parameter-entities”, false);
dbf.setFeature(“http://apache.org/xml/features/disallow-doctype-decl”, true);
how Exploit:
Craft malicious XLEF file with external entities referencing internal resources. Distribute file to users or upload to processing services. Trigger parsing to exploit SSRF or data leakage.
Protection from this CVE
Update Bio-Formats version. Disable XML external entities. Use secure parser configuration.
Impact:
SSRF attacks. Local file read. Denial of service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
