Description

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value. To remediate this issue, users should upgrade to version 4.3.0 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-11T17:17:08.927Z",
  "pubdate": "2026-09-11T17:17:08.927Z",
  "executiveSummary": "The AWS Advanced JDBC Wrapper, specifically the RemoteQueryCachePlugin, contains an Improper Restriction of XML External Entity (XXE) References vulnerability. This flaw enables an attacker with write access to the shared cache infrastructure to perform unauthorized disclosure of sensitive files located on application hosts.\nBy injecting crafted XML data into a cached column value, an adversary can coerce the application to parse malicious XML entities during the cache retrieval process. The impact of this vulnerability is critical, as it can lead to the exfiltration of sensitive configuration data, including stored database credentials and IAM role security tokens.\nThe vulnerability affects versions 3.3.0 through 4.2.0. Successful exploitation requires an attacker to possess the capability to write to the cache storage mechanism used by the plugin. Organizations utilizing this wrapper should prioritize upgrading to version 4.3.0 or later to eliminate the underlying parser misconfiguration.",
  "technicalDetails": "The vulnerability originates from a failure to properly configure the XML parser within the RemoteQueryCachePlugin when processing data retrieved from the cache. The affected component deserializes or parses cached query results, which may contain XML-formatted data structures. Because the XML parser is not configured to disable external entity expansion or external parameter entity resolution, it is susceptible to XXE injection attacks.\nThe root cause is the reliance on a default-configured XML parser that permits the definition and resolution of external entities via DOCTYPE declarations in the XML input. When the RemoteQueryCachePlugin fetches and parses a cached value, it inadvertently processes any embedded XML instructions provided by the attacker.\nThe attack flow follows a specific progression: First, the attacker must gain unauthorized write access to the shared cache infrastructure (e.g., Redis or a similar key-value store used by the JDBC wrapper). Second, the attacker injects a malicious XML payload into a cached column value. This payload typically includes an entity declaration targeting a local file on the application host, such as /proc/self/environ, credentials files, or metadata service endpoints.\nThird, when an application host retrieves the poisoned cached value from the infrastructure, the RemoteQueryCachePlugin component parses the XML data. During this phase, the XML parser interprets the malicious entity reference, triggering a read request to the specified system file or local resource. Finally, the contents of the retrieved file are integrated into the query results, which may then be logged, displayed in the application interface, or returned as part of the query result set to the attacker.\nThe exploitation of this vulnerability is highly effective for post-exploitation data gathering. Since the wrapper is frequently used in cloud-native environments, the exposure of IAM role credentials stored within the application environment variables or the metadata service allows the attacker to pivot from a cache-write capability to full identity compromise. The vulnerability does not require authentication to the database itself, provided the attacker can influence the shared cache state, making it a critical threat to multi-tenant or shared-cache architectures where internal segmentation is insufficient."
}