Skip to main content

Improper Restriction of XML External Entity Reference

CVE-2017-20151

High
9.8/10

Summary

A vulnerability classified as problematic was found in iText RUPS versions through 7.0.1 and iText PDF version 5.0.6. The issue is an XML External Entity (XXE) injection vulnerability that affects the "XfaFile" method in "src/main/java/com/itextpdf/rups/model/XfaFile.java". This method constructs an XFA file from a resource, like an XML file. If a maliciously crafted XML file is provided, there is no entity resolution prevention in place, allowing an attacker to potentially interact with any back-end or external systems that the application itself can access. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-611 - Improper Restriction of XML External Entity Reference

Listed 4th in the 'OWASP Top Ten', XML External Entities (XXE) vulnerability allows attackers to provide an XML input that contains an external entity. When the XML is parsed, it can cause data extraction and manipulation, execution of commands, denial-of-service attacks, and server-side request forgery.

References

Advisory Timeline

  • Published