Listen to this Post
How the CVE Works
The vulnerability exists in `com.powsybl.commons.xml.XmlReader` due to insecure XML parsing. Attackers can exploit XML External Entity (XXE) processing to read arbitrary files on the system. In some cases, Server-Side Request Forgery (SSRF) is possible, enabling unauthorized network requests. This occurs when untrusted XML input (e.g., CGMES or XIIDM files) is processed without proper restrictions on external entities. Multi-tenant applications are particularly at risk if they allow user-submitted XML files.
DailyCVE Form
Platform: powsybl-core
Version: <6.7.2
Vulnerability: XXE & SSRF
Severity: Critical
Date: 2023-06-15
Prediction: Patch expected by 2023-07-10
What Undercode Say
<!-- Malicious XML exploiting XXE --> <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <foo>&xxe;</foo>
// Vulnerable code snippet XmlReader reader = new XmlReader(untrustedXML);
How Exploit
- Craft malicious XML with external entities.
- Submit to vulnerable XML parser.
- Extract sensitive file contents.
Protection from this CVE
- Upgrade to powsybl-commons ≥6.7.2.
- Disable external entities in XML parsing.
- Validate/sanitize user-supplied XML.
Impact
- Unauthorized file access.
- Privilege escalation.
- SSRF leading to internal network exposure.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
