Summary
MPXJ's MerlinReader parses XML stored in a Merlin project SQLite database with external entity processing enabled. A crafted database may cause the parser to access arbitrary local files, although subsequent XML handling may make disclosure of the file contents unlikely.
Affected context
The issue occurs when MPXJ versions in the affected range use MerlinReader to process XML from the ZTIMEINTERVALS column of a Merlin project SQLite database. Risk exists when an attacker can supply or cause processing of a crafted database and the XML parser permits document type declarations and external entity resolution.
Exploit preconditions
- Attack surface: Merlin project database ingestion through MPXJ's MerlinReader
- Required access: Ability to provide, replace, or influence a Merlin SQLite database processed by the application
- Trigger point: XML parsing of the
ZTIMEINTERVALScolumn - Why exploitation is possible: Default XML parser settings leave document type declarations and external entities enabled, allowing crafted XML to request local resources during parsing
Why this happens
The underlying bug is insecure XML parser configuration. MerlinReader creates a DocumentBuilder without disabling document type declarations and external entity resolution, so XML from a database is treated as trusted despite being attacker-influenced. This maps to CWE-611: Improper Restriction of XML External Entity Reference, in which external entity processing can make a parser access local files or other resources.
Potential impact
- An attacker may cause access to arbitrary local files available to the parsing process
- Sensitive information could be exposed if parsed content is returned or persisted
- The application could make unintended requests to local or reachable resources
- Processing of crafted project databases could cause errors or availability impact
General mitigation guidance
Mitigation generally focuses on making XML parsing safe by default and reducing trust in imported project databases.
Common defensive patterns include:
- Disable document type declarations and external entity resolution in XML parser configuration
- Use hardened, non-network-capable parser settings for untrusted XML
- Apply strict schema and content validation after safe parsing
- Treat imported SQLite databases and embedded XML as untrusted input
- Run file-processing components with least-privilege filesystem and network access
- Avoid exposing sensitive files to processes that handle untrusted project data
How teams detect issues like this
Organizations can detect related issues through:
- Static analysis rules identifying XML parser construction without secure entity settings
- Code review checks for
DocumentBuilderFactoryinstances that do not explicitly restrict DTDs and external entities - Tests using XML fixtures containing document type declarations and external entity references
- Dependency and policy checks covering libraries that process attacker-supplied project files or databases
- Runtime monitoring for unexpected file access or outbound requests from document-processing components
Automated code review and application security tools may help identify insecure XML parser configurations.
