CVE-2022-4725: Server-Side Request Forgery (SSRF) (CWE-918)
value: A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to server-side request forgery. Upgrading to version 2.59.1 is able to address this issue. The name of the patch is c3e6d69422e1f0c80fe53f2d757b8df97619af2b. It is recommended to upgrade the affected component. The identifier VDB-216737 was assigned to this vulnerability.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 9.8
Published: 2022-12-27T15:15Z
Repository: https://github.com/aws-amplify/aws-sdk-android
Language: Java
Files changed: aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java, aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java
Commit date: 2022-12-04 23:56:38 -0800
Commit message: fix(core): added fix for xml parser (#3100)

* added fix for xml parser vulnerability

* added fix for xml parser vulnerability

Co-authored-by: Banji Jolaoso <banjij@amazon.com>
Diff: diff --git a/aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java b/aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java
index caed9c468..7c413fd59 100644
--- a/aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java
+++ b/aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java
@@ -107,13 +107,14 @@ public class RegionMetadataParser {
             final boolean endpointVerification) throws IOException {
 
         Document document;
         try {
 
-            DocumentBuilderFactory factory =
-                    DocumentBuilderFactory.newInstance();
-
+            DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+            factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            factory.setXIncludeAware(false);
+            factory.setExpandEntityReferences(false);
             DocumentBuilder documentBuilder = factory.newDocumentBuilder();
             document = documentBuilder.parse(input);
 
         } catch (IOException exception) {
             throw exception;
diff --git a/aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java b/aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java
index 18c35fc2f..746c99029 100644
--- a/aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java
+++ b/aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java
@@ -43,11 +43,29 @@ import javax.xml.xpath.XPathFactory;
 public class XpathUtils {
 
     /** Shared logger */
     private static Log log = LogFactory.getLog(XpathUtils.class);
 
-    private static DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+    private static DocumentBuilderFactory factory = getDocumentBuilderFactory();
+
+
+    /**
+     * Creates new documentbuilderfactory object
+     * @return DocumentBuilderFactory.
+     */
+    private static DocumentBuilderFactory getDocumentBuilderFactory() {
+        try {
+            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+            dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            dbf.setXIncludeAware(false); // Default false for java 8. Disable XML Inclusions leading to SSRF - https://portswigger.net/web-security/xxe/lab-xinclude-attack
+            dbf.setExpandEntityReferences(false);
+            return dbf;
+        }
+        catch (ParserConfigurationException exception){
+            return null;
+        }
+    }
 
     /**
      * InputStream to Document.
      * @param is the input stream.
      * @return the Document.

Vulnerable code:             DocumentBuilderFactory factory =
                    DocumentBuilderFactory.newInstance();

    private static DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
Fixed code:             DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
            factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
            factory.setXIncludeAware(false);
            factory.setExpandEntityReferences(false);
    private static DocumentBuilderFactory factory = getDocumentBuilderFactory();


    /**
     * Creates new documentbuilderfactory object
     * @return DocumentBuilderFactory.
     */
    private static DocumentBuilderFactory getDocumentBuilderFactory() {
        try {
            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
            dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
            dbf.setXIncludeAware(false); // Default false for java 8. Disable XML Inclusions leading to SSRF - https://portswigger.net/web-security/xxe/lab-xinclude-attack
            dbf.setExpandEntityReferences(false);
            return dbf;
        }
        catch (ParserConfigurationException exception){
            return null;
        }
    }