Allure Report allows Improper XXE Restriction via DocumentBuilderFactory
Date: 2025-06
Affected: maven/io.qameta.allure.plugins:trx-plugin, maven/io.qameta.allure.plugins:junit-xml-plugin, maven/io.qameta.allure.plugins:xunit-xml-plugin
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-52888
CWE: CWE-611
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

### Summary A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2. The plugin fails to securely configure the XML parser (`DocumentBuilderFactory`) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF). ### Details In `\allure2-main\plugins\xunit-xml-plugin\src\main\java\io\qameta\allure\xunitxml\XunitXmlPlugin.java` the application uses `DocumentBuilderFactory` without disabling DTDs or external entities. By generating a report with a malicious xml file within it, an attacker can perform XXE to leverage SSRF, or to read system files. ### PoC To recreate this vulnerability, you need to install allure for command-line (In my POC I used a Windows 11 Machine). 1. Create a folder called `allure`, and within it, create a malicious XML file. I will attach my SSRF and file reading payloads, however, for the rest of the POC, I will focus on reading system files for better screenshots. ##SSRF (replace webhook link with your own) ![image](https://github.com/user-attachments/assets/a1a9a438-b6f1-4675-973f-a43847a84519) ##Reading System Files ![image](https://github.com/user-attachments/assets/eb0e1e60-1f76-42e7-b68d-2137bed62fe9) 2. Put the malicious .xml file into the `allure` directory created previously 3. Run the following command to run the report `allure generate C:\path\to\directory\


Mitigations:

Architectural layers (MAESTRO):