Description

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-11T15:17:06.357Z",
  "pubdate": "2026-09-11T15:17:06.357Z",
  "executiveSummary": "This vulnerability is an XML External Entity (XXE) injection flaw occurring within the application's XML batch processing functionality when the XPath option is enabled.\nThe root cause is a misconfigured default XPath/JAXP parser that fails to enforce restrictions on external entity resolution.\nThe vulnerability poses a critical risk to data confidentiality and service availability, allowing an unauthenticated attacker to perform arbitrary file disclosure, server-side request forgery (SSRF), and denial-of-service (DoS) attacks.\nBy manipulating the incoming XML batch input, an attacker can force the XML parser to process malicious Document Type Definitions (DTDs), leading to the exfiltration of sensitive local system files or internal network resources.\nThe impact is significant, as the exposure of credentials, configuration files, or internal metadata can facilitate further compromise of the host environment.\nThis flaw is exploitable over the network and does not require prior authentication, making it a high-priority security concern for systems utilizing the affected XML/XPath processing pipeline.",
  "technicalDetails": "The vulnerability resides in the application's XML processing pipeline, specifically within the module responsible for XPath-based batch processing. The underlying JAXP (Java API for XML Processing) implementation is configured with default settings that do not explicitly disable DTD processing or external entity expansion.\nAn XXE injection occurs when the parser treats user-supplied XML content containing a crafted Document Type Definition (DTD) as a trusted document. By defining an external entity, an attacker can instruct the XML parser to fetch content from a URI, which may point to a local file on the filesystem (e.g., /etc/passwd or application configuration files) or an internal network address.\nThe attack flow begins when an attacker submits a malicious XML document through the batch processing endpoint. Upon ingestion, the parser encounters the 'DOCTYPE' declaration. Because external entity resolution is enabled by default, the parser attempts to resolve the URI specified in the entity definition. If the resource is a local file, the parser reads the content and includes it within the XML tree. If the resource is a URL, the parser may initiate an outbound connection, facilitating SSRF.\nIn the context of XPath processing, the attacker can use the 'SYSTEM' or 'PUBLIC' identifiers to alias external resources. When the XPath engine evaluates the document, it may inadvertently return the content of the external entity to the user if the application logic outputs the results of the XPath query. Even if direct output is not provided, the parser's attempt to fetch non-existent or malicious resources can result in a Denial-of-Service (DoS) condition, such as an XML entity expansion attack ('Billion Laughs') which consumes excessive memory or CPU cycles.\nThe vulnerability is primarily characterized by the lack of defensive configuration in the 'DocumentBuilderFactory' or 'SAXParserFactory' used during the batch processing routine. Without explicit 'FEATURE_SECURE_PROCESSING' or the manual disabling of DTDs, the processor remains susceptible. Exploitation is typically straightforward, requiring only the ability to supply XML input to the vulnerable processing endpoint. Post-exploitation, an attacker gains the ability to map internal network topology, harvest credentials from configuration files, or disrupt application availability through recursive entity expansion."
}