[BATIK-1018] "XML External Entities" vulnerability

• Type: Bug
• Status: Resolved
• Resolution: Fixed
• Affects Version/s: 1.8
• Fix Version/s: 1.9
• Component/s: Web Site
• Environment: Operating System: All; Platform: All
• Assignee: Batik Developer's Mailing list
• Reporter: Nicolas GREGOIRE
• Created: 25/Jul/12 16:32
• Updated: 11/Apr/17 11:01
• Resolved: 08/Mar/15 18:01

Description

During visualization with Squiggle or rasterization via the CLI tool, XML external entities defined in the DTD are dereferenced and the content of the target file is included in the output.

The impact of this vulnerability range form denial of service to file disclosure. Under Windows, it can also be used to steal LM/NTLM hashes.

For some additional information about XXE attacks, please refer to http://cwe.mitre.org/data/definitions/827.html

How to reproduce:
$> rasterizer xxe.svg -d xxe.png

Issue Links

• is related to: BATIK-1139 SSRF through external DTD resolution
• relates to: BATIK-1113 Hard to solve XML External Entities problem