mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.28.30, 3.30.32, 3.31.24, 3.33.16, 4.0.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- mapfish mapfish-print
From 3.0.0 · fixed in 3.28.30; From 3.29.0 · fixed in 3.30.32; From 3.31.0 · fixed in 3.31.24; From 3.32.0 · fixed in 3.33.16; From 4.0.0 · fixed in 4.0.5
- mapfish org.mapfish.print.print-lib
From 3.0.0 · fixed in 3.28.30; From 3.29.0 · fixed in 3.30.32; From 3.31.0 · fixed in 3.31.24; From 3.32.0 · fixed in 3.33.16; From 4.0.0 · fixed in 4.0.5
- mapfish org.mapfish.print.print-servlet
From 3.0.0 · fixed in 3.28.30; From 3.29.0 · fixed in 3.30.32; From 3.31.0 · fixed in 3.31.24; From 3.32.0 · fixed in 3.33.16; From 4.0.0 · fixed in 4.0.5
- org.mapfish.print:print-libMaven
From 3.0.0 · fixed in 3.28.30
- org.mapfish:print.print-servletMaven
From 3.0.0 · fixed in 3.28.30
- org.mapfish.print:print-libMaven
From 3.29.0 · fixed in 3.30.32
- org.mapfish.print:print-servletMaven
From 3.29.0 · fixed in 3.30.32
- org.mapfish.print:print-servletMaven
From 3.31.0 · fixed in 3.31.24
- org.mapfish.print:print-libMaven
From 3.32.0 · fixed in 3.33.16
- org.mapfish.print:print-servletMaven
From 3.32.0 · fixed in 3.33.16
- org.mapfish.print:print-libMaven
From 3.34.0 · fixed in 4.0.5
- org.mapfish.print:print-servletMaven
From 3.34.0 · fixed in 4.0.5