Uploaded image for project: 'JAPI'
  1. JAPI
  2. JAPI-462 Static Security Scan Issues
  3. JAPI-463

HPCCFileSprayClient - Resolving XML external entity in user-controlled data

    XMLWordPrintable

Details

    • Sub-task
    • Status: Resolved
    • Critical
    • Resolution: Fixed
    • 8.8.x
    • 8.8.0
    • WSClient
    • None

    Description

      https://github.com/rpastrana/HPCC4J/security/code-scanning/5

       

      Parsing untrusted XML files with a weakly configured XML parser may lead to an XML External Entity (XXE) attack. This type of attack uses external entity references to access arbitrary files on a system, carry out denial of service, or server side request forgery. Even when the result of parsing is not returned to the user, out-of-band data retrieval techniques may allow attackers to steal sensitive data. Denial of services can also be carried out in this situation.

      Attachments

        Activity

          People

            rpastrana Rodrigo Pastrana
            rpastrana Rodrigo Pastrana
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: