CVE-2017-5661 Improper Restriction of XML External Entity Reference in Apache FOP
Attackers can exploit XML External Entity vulnerabilities in Apache FOP to read server files or cause denial of service via malicious SVG inputs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-5661?
CVE-2017-5661 is a high-severity vulnerability in Apache FOP, published on 18 Apr 2017. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
Weakness: CWE-611
Which versions are affected by CVE-2017-5661?
2 open source packages ship an affected version, including org.apache.xmlgraphics:fop. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.xmlgraphics:fop Maven | All versions | 2.2 |
org.apache.xmlgraphics:fop Maven | All versions | 2.2 |
Products include Apache Formatting Objects Processor.
How do I fix CVE-2017-5661?
Upgrade org.apache.xmlgraphics:fop to 2.2 or later.
Is CVE-2017-5661 being exploited?
There is no known exploitation of CVE-2017-5661 in the wild and no public exploit code.
Other vulnerabilities in Apache FOP
Sources
Also known as CLSA-2026-1779929352, DEBIAN-CVE-2017-5661, DLA-927-1, DSA-3864-1, GHSA-5hg8-r9vq-gjqp, UBUNTU-CVE-2017-5661 and 1 more.