Critical, CVSS 9.9MavenPublished
GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling
GHSA-826p-4gcg-35vw
- Affected
- Maven org.geotools:gt-wfs-ng >= 33.0, < 33.1; >= 32.0, < 32.3; >= 29.0, <= 31.6; < 28.6.1
- Fixed in
- 32.333.131.728.6.1· Vendor fix available
- Issue
- GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. Impact This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITYRESOLVER connection parameter was not being used as intended. Resolution GeoTools API change allows EntityResolver to be supplied to the following methods: With this API change the gt-wfs-ng WFS DataStore ENTITYRESOLVER parameter is now used. Reference GHSA-jj54-8f66-c5pc: Describes the impact of the gt-xsd-core vulnerability on the GeoServer WFS protocol, resulting in both Service Side Request Forgery (SSRF) and Out-of-Band (OOB) data exfiltration of local files. GHSA-2p76-gc46-5fvc: Describes the impact of the…
Recommended action: Upgrade to 33.1, 32.3, 31.7 or 28.6.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.