CVE-2020-10683

Overview

Prior to versions 2.0.3 and 2.1.3, the dom4j library was distributed with insecure default settings that permitted the processing of external Document Type Definitions (DTDs) and External Entities during XML parsing. This design choice exposed applications to XML External Entity (XXE) attacks, potentially allowing remote attackers to exfiltrate sensitive local files, perform Server-Side Request Forgery (SSRF), or trigger Denial of Service. Although the library was inherently vulnerable by default, the OWASP XXE Prevention Cheat Sheet provided long-standing documentation on manually hardening the SAXReader configuration to disable these features and ensure secure processing.

Details

Module Info

• Product: dom4j
• Affected packages: dom4j
• Affected versions: 1.6.1
• GitHub repository: https://github.com/dom4j/dom4j
• Published packages: https://central.sonatype.com/artifact/dom4j/dom4j
• Package manager: Maven
• Fixed In: NES for dom4j v1.6.2

Vulnerability Info

dom4j before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Note: This advisory applies to dom4j:dom4j version 1.x legacy artifacts.  To resolve this a change to the latest version of org.dom4j:dom4j is recommended.

Mitigation

• Upgrade dom4j to versions 2.1.3, 2.0.3 (or newer) to ensure the SAXReader uses secure default settings that disable external entities.
• Configure SAXReader manually to disable external DTDs and general entities by setting the http://apache.org/xml/features/disallow-doctype-decl feature to true.
• Use the SAXReader.createDefault() method (available in patched versions) to instantiate readers with pre-configured security hardening.

Steps To Reproduce

1. Use an application with a vulnerable version of dom4j (before 2.0.3 or 2.1.3) that utilizes io.SAXReader to parse XML from untrusted sources.
2. Identify an input vector where the application accepts XML data (e.g., an API endpoint, file upload, or configuration import).
3. Submit a crafted XML payload containing an external entity definition, such as ]>, and reference it in the XML body.
4. Observe the response or side effects, such as the contents of the sensitive local file being leaked in the output or a connection attempt to an external URL (SSRF).