Listen to this Post
How the CVE Works
The vulnerability stems from insufficient XML external entity (XXE) disabling in DSpace’s XML parsing during archive imports (Simple Archive Format) and external service responses (ArXiv, Crossref, etc.). Attackers can craft malicious XML payloads to:
– Exfiltrate server files via `file://` URIs.
– Trigger SSRF via remote URL inclusion.
– Inject metadata via external entity references.
Exploitation requires admin privileges for SAF imports, while external source imports rely on compromised upstream services. The flaw resides in insecure Java XML parser configurations, allowing arbitrary data retrieval under the Tomcat user’s context.
DailyCVE Form
Platform: DSpace
Version: <7.6.4, <8.2, <9.1
Vulnerability: XXE Injection
Severity: Critical
Date: 2023-XX-XX
Prediction: Patch by 2023-Q4
What Undercode Say
git apply dspace-xxe-patch.patch mvn -U clean package ant update
<!-- Vulnerable XML parser config --> <xml-parser external-entities="true"/>
How Exploit
- Craft SAF archive with
<!ENTITY xxe SYSTEM "file:///etc/passwd">.
2. Convince admin to import malicious ZIP.
3. Exfiltrate data via metadata fields.
Protection from this CVE
- Upgrade to DSpace 7.6.4+/8.2+/9.1+.
- Disable external entities in XML parsers.
- Audit SAF imports.
Impact
- Arbitrary file read (Tomcat user).
- SSRF via HTTP requests.
- Metadata poisoning.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
