CVE-2018-1000632

Overview

The dom4j library, in versions prior to 2.1.1, is affected by a CWE-91: XML Injection vulnerability specifically within the Element class. The flaw resides in the addElement and addAttribute methods, which fail to properly sanitize or escape special XML characters in user-provided input. Consequently, an attacker can supply malicious strings containing XML tags or attributes to manipulate the structure of generated XML documents. This structural tampering can lead to data corruption, logic bypasses, or unauthorized information disclosure within applications that rely on dom4j for XML construction. The issue was addressed and resolved in version 2.1.1 and subsequent releases.

Details

Module Info

• Product: dom4j
• Affected packages: dom4j
• Affected versions: 1.6.1
• GitHub repository: https://github.com/dom4j/dom4j
• Published packages: https://central.sonatype.com/artifact/dom4j/dom4j
• Package manager: Maven
• Fixed In: NES for dom4j v1.6.1-dom4j-1.6.2

Vulnerability Info

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

Note: This advisory applies to dom4j:dom4j version 1.x legacy artifacts.  To resolve this a change to the latest version of org.dom4j:dom4j is recommended.

Mitigation

• Upgrade dom4j to versions 2.1.1 or 2.0.3 (or newer) to ensure that addElement and addAttribute methods correctly escape special characters.
• Sanitize user-provided strings before passing them to XML construction methods to prevent structural manipulation of the document.
• Implement XML Schema (XSD) validation for any generated or received XML to ensure the document structure remains within expected bounds.

Steps To Reproduce

1. Use an application that depends on a vulnerable version of dom4j (e.g., 1.6.1 or 2.1.0) and uses Element.addElement() or Element.addAttribute() with user input.
2. Identify a feature where a user-provided string is used to build an XML element or attribute (e.g., a profile name or description field).
3. Submit a crafted payload containing XML meta-characters or structural elements, such as ">content<original attr=".
4. Observe the generated XML output to verify that the injected characters were not escaped, resulting in unauthorized elements or broken document structure.