CVE-2021-33950: Improper Restriction of XML External Entity Reference (CWE-611)
value: An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 7.5
Published: 2023-02-17T18:15Z
Repository: https://github.com/openkm/document-management-system
Language: Java
Files changed: src/main/java/com/openkm/extractor/OpenOfficeTextExtractor.java, src/main/java/com/openkm/extractor/XMLTextExtractor.java
Commit date: 2021-05-20 08:40:19 +0200
Commit message: XXE injection security vulnerability

Fix #287

Diff: diff --git a/src/main/java/com/openkm/extractor/OpenOfficeTextExtractor.java b/src/main/java/com/openkm/extractor/OpenOfficeTextExtractor.java
index f8422d9..fcc433c 100644
--- a/src/main/java/com/openkm/extractor/OpenOfficeTextExtractor.java
+++ b/src/main/java/com/openkm/extractor/OpenOfficeTextExtractor.java
@@ -67,12 +67,14 @@ public class OpenOfficeTextExtractor extends AbstractTextExtractor {
 		try {
 			SAXParserFactory saxParserFactory = SAXParserFactory.newInstance();
 			saxParserFactory.setValidating(false);
 			SAXParser saxParser = saxParserFactory.newSAXParser();
 			XMLReader xmlReader = saxParser.getXMLReader();
-			xmlReader.setFeature("http://xml.org/sax/features/validation", false);
 			xmlReader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+			xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+			xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
+			xmlReader.setFeature("http://xml.org/sax/features/validation", false);
 
 			ZipInputStream zis = new ZipInputStream(stream);
 			ZipEntry ze = zis.getNextEntry();
 
 			while (ze != null && !ze.getName().equals("content.xml")) {
diff --git a/src/main/java/com/openkm/extractor/XMLTextExtractor.java b/src/main/java/com/openkm/extractor/XMLTextExtractor.java
index 8cf7124..1393538 100644
--- a/src/main/java/com/openkm/extractor/XMLTextExtractor.java
+++ b/src/main/java/com/openkm/extractor/XMLTextExtractor.java
@@ -79,10 +79,14 @@ public class XMLTextExtractor extends AbstractTextExtractor {
 
 			// TODO: Use a pull parser to avoid the memory overhead
 			SAXParserFactory factory = SAXParserFactory.newInstance();
 			SAXParser parser = factory.newSAXParser();
 			XMLReader reader = parser.getXMLReader();
+			reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+			reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+			reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
+			reader.setFeature("http://xml.org/sax/features/validation", false);
 			reader.setContentHandler(handler);
 			reader.setErrorHandler(handler);
 
 			// It is unspecified whether the XML parser closes the stream when
 			// done parsing. To ensure that the stream gets closed just once,

Vulnerable code: 			xmlReader.setFeature("http://xml.org/sax/features/validation", false);
Fixed code: 			xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
			xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
			xmlReader.setFeature("http://xml.org/sax/features/validation", false);
			reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
			reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
			reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
			reader.setFeature("http://xml.org/sax/features/validation", false);