GHSA-5vvx-3h34-f3gj: XEE
Impact MPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration.
Patches The patch is included in MPXJ 16.4.1
Workarounds Potential workarounds include: Avoid reading Merlin project files with MPXJ Only accept Merlin project files from trusted sources Preprocess Merlin SQLite databases to strip doctype declarations from the ZTIMEINTERVALS column
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/mpxjto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
nuget/net.sf.mpxj-for-vbto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
nuget/net.sf.mpxj-for-csharpto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
nuget/net.sf.mpxjto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
nuget/MPXJ.Netto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
rubygems/mpxjto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
maven/net.sf.mpxj:mpxjto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
MPXJto a version that resolves this vulnerability.Fixed in 16.4.1 - Compensating control
Avoid reading Merlin project files with MPXJ.
- Compensating control
Only accept Merlin project files from trusted sources.
- Compensating control
Preprocess Merlin SQLite databases to strip doctype declarations from the ZTIMEINTERVALS column.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when they use MPXJ to read Merlin project SQLite files, specifically XML stored in the ZTIMEINTERVALS column. Systems that do not process Merlin project files are not described as affected.
What must an attacker provide to trigger the issue?
An attacker needs to supply a carefully crafted Merlin project SQLite file containing an XML payload with a doctype declaration in the ZTIMEINTERVALS column. No authentication or user interaction is indicated by the provided severity vector.
Is sensitive file content likely to be disclosed remotely?
The crafted XML can cause an arbitrary file to be read, but MPXJ's subsequent processing makes the file contents unlikely to be available for exfiltration. The provided information does not state that disclosure is impossible.
What can be done before upgrading?
Avoid reading Merlin project files with MPXJ, accept Merlin files only from trusted sources, or preprocess Merlin SQLite databases to remove doctype declarations from the ZTIMEINTERVALS column. The patch is included in MPXJ 16.4.1.