CVE-2017-5662 Improper Restriction of XML External Entity Reference in Apache Batik

What is CVE-2017-5662?

CVE-2017-5662 is a high-severity vulnerability in Apache Batik, published on 18 Apr 2017. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.

Weakness: CWE-611

Which versions are affected by CVE-2017-5662?

2 open source packages ship an affected version, including org.apache.xmlgraphics:batik. It affects 1 product.

Products include Apache Batik.

How do I fix CVE-2017-5662?

Upgrade org.apache.xmlgraphics:batik to 1.9 or later.

Is CVE-2017-5662 being exploited?

There is no known exploitation of CVE-2017-5662 in the wild and no public exploit code.

Other vulnerabilities in Apache Batik

• CVE-2018-8013 Deserialization of Untrusted Data in Apache Batik Critical 9.8
• CVE-2020-11987 Server-side request forgery (SSRF) in Apache Batik High 8.2
• CVE-2022-41704 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input High 7.5
• CVE-2022-42890 Apache Batik prior to 1.16 allows RCE via scripting High 7.5
• CVE-2022-40146 Jar url should be blocked by DefaultScriptSecurity High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2017-5662, DLA-926-1, GHSA-qwgx-59jw-qfg9, UBUNTU-CVE-2017-5662, USN-3280-1.