Description

The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-11T15:17:04.337Z",
  "pubdate": "2026-09-11T15:17:04.337Z",
  "executiveSummary": "The XSLT Transformer component suffers from an XML External Entity (XXE) injection vulnerability due to the insecure instantiation of the TransformerFactory. By failing to explicitly disable external entity processing and DTD (Document Type Definition) loading, the application becomes susceptible to malicious XML inputs.\nThis vulnerability allows an attacker to manipulate XML inputs to trigger unauthorized local file system reads, perform Server-Side Request Forgery (SSRF) attacks against internal network infrastructure, or initiate Denial-of-Service (DoS) conditions through entity expansion loops (e.g., Billion Laughs attack).\nThe impact is significant, potentially resulting in full disclosure of sensitive configuration files, internal system credentials, or metadata stored on the host server. Furthermore, the ability to perform blind SSRF enables attackers to probe internal services behind a firewall that are not directly reachable from the public internet. Exploitation does not typically require prior authentication, as the attack vector relies on the processing of untrusted XML streams or files provided to the transformer. Organizations utilizing custom XSLT processing logic that does not strictly adhere to secure XML parsing standards are at high risk of data exfiltration and complete system instability.",
  "technicalDetails": "The root cause of this vulnerability lies in the default behavior of standard Java XML processing libraries, specifically within the javax.xml.transform.TransformerFactory implementation. When a TransformerFactory is initialized without custom security configuration, it typically defaults to a permissive state that honors DTDs and resolves external entities embedded within the input XML or XSLT documents.\nThe exploitation mechanism leverages the XML specification's feature for external entities. An attacker crafts a malicious XML document containing a DOCTYPE declaration that defines an external entity pointing to a sensitive local resource, such as 'file:///etc/passwd', or a URL targeting internal network services. When the XSLT Transformer processes this input, the underlying XML parser attempts to resolve the external entity by fetching the content from the specified URI or file path.\nThe attack flow proceeds as follows: First, the attacker identifies an input vector where the application accepts user-supplied XML data intended for XSLT transformation. Second, the attacker injects an XML payload containing an entity definition that references an out-of-band resource or a local file. Third, upon submission, the application’s TransformerFactory parses the document and performs an XML External Entity expansion. If the parser is not configured to disallow DTDs or external entities, it successfully retrieves the content of the referenced URI/file. Finally, the application may inadvertently reflect the contents of the fetched resource in the transformation output or use the retrieved data in downstream processing, leading to information leakage.\nFurthermore, the vulnerability enables DoS attacks. By defining recursive entities (the 'Billion Laughs' attack), an attacker can force the XML parser to allocate excessive memory, leading to an 'Out of Memory' (OOM) error and application crash. Because the TransformerFactory serves as the entry point for XSLT transformations, any module within the application pipeline that utilizes this insecure factory is immediately exposed to these threats. The lack of proper feature configuration (specifically ignoring XMLConstants.ACCESS_EXTERNAL_DTD and XMLConstants.ACCESS_EXTERNAL_STYLESHEET) prevents the parser from blocking malicious input patterns, effectively granting the attacker control over the file system interaction capabilities of the application process context."
}