[LUCENE-8291] Possible security issue when parsing XML documents containing external entity references

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 7.2.1
• Fix Version/s: 7.4, 8.0
• Component/s: modules/queryparser
• Lucene Fields: New
• Assignee: Uwe Schindler
• Reporter: Hendrik Saly
• Created: 02/May/18 19:08
• Updated: 28/Aug/22 15:29
• Resolved: 27/Jun/18 08:38

Description

It appears that in QueryTemplateManager.java lines 149 and 198 and in DOMUtils.java line 204 XML is parsed without disabling external entity references (XXE). This is described in http://cwe.mitre.org/data/definitions/611.html and possible mitigations are listed here: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet

All recent versions of lucene are affected.