GHSA-cjx3-73hr-rpw7: XEE
http4s-scala-xml provides EntityDecoder[F, scala.xml.Elem] instances that parse XML message bodies. These decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.
An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks. An attacker can craft a request that:
- discloses local files readable by the service process, - performs server-side request forgery (SSRF) against internal network resources, and/or - causes denial of service through entity expansion.
Impact
Any service that derives an XML EntityDecoder from this library and parses attacker-controlled input is affected.
Patches
The default SAXParserFactory is now hardened: - secure processing is enabled - DOCTYPE declarations are disallowed - external general/parameter entities and external DTD loading are disabled - DTD URIs are not resolved - XInclude is disabled.
These defaults match scala.xml.XMLLoader's defaults since 2.0.0.
Workarounds
Before upgrading, override ElemInstances#saxFactory with a hardened factory.
scala val secured = new ElemInstances { override protected val saxFactory = { val f = javax.xml.parsers.SAXParserFactory.newInstance f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) // etc. f } } import secured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.http4s:http4s-scala-xml_3to a version that resolves this vulnerability.Fixed in 1.0.0-M39 - Upgrade
Upgrade
maven/org.http4s:http4s-scala-xml_3to a version that resolves this vulnerability.Fixed in 0.24.1 - Upgrade
Upgrade
maven/org.http4s:http4s-scala-xml_2.13to a version that resolves this vulnerability.Fixed in 1.0.0-M39 - Upgrade
Upgrade
maven/org.http4s:http4s-scala-xml_2.13to a version that resolves this vulnerability.Fixed in 0.24.1 - Upgrade
Upgrade
maven/org.http4s:http4s-scala-xml_2.12to a version that resolves this vulnerability.Fixed in 0.24.1 - Configuration
Before upgrading, override ElemInstances#saxFactory with a hardened SAXParserFactory and configure it to disallow DOCTYPE declarations, disable external general and parameter entities and external DTD loading, disable XInclude, and enable secure processing.
http4s-scala-xml EntityDecoder / javax.xml.parsers.SAXParserFactory XML parser security features = disallow-doctype-decl=true; external general entities disabled; external parameter entities disabled; external DTD loading disabled; XInclude disabled; secure processing enabled
Event History
Frequently Asked Questions
Which deployments are exposed?
Any service using an XML EntityDecoder derived from this library to parse attacker-controlled XML input is affected. This includes the listed http4s-scala-xml artifacts for Scala 2.12, 2.13, and 3 when those decoders handle untrusted requests.
Does exploitation require authentication or user interaction?
No. The stated attack vector is network-based with low complexity, no privileges required, and no user interaction required; an attacker needs only a way to submit XML that the affected decoder parses.
Are default parser settings safe?
No. The affected decoders used an unconfigured SAXParserFactory, and JDK default settings resolve DOCTYPE declarations, external entities, and external DTDs. The hardened defaults disable these behaviors, enable secure processing, disable XInclude, and prevent DTD URI resolution.
What could an attacker obtain or do through a vulnerable XML endpoint?
An attacker may disclose local files readable by the service process, make requests to internal network resources through SSRF, or cause denial of service through entity expansion.