Summary
http4s-scala-xml XML entity decoders use a SAX parser without disabling external entities, DTD processing, or related XML features. When an application parses untrusted XML requests, an attacker may read local files, access internal services through SSRF, or trigger denial of service through entity expansion.
Affected context
The vulnerability occurs in applications that use http4s-scala-xml EntityDecoder[F, scala.xml.Elem] instances to process XML message bodies. Risk is present when request content can be influenced by untrusted clients and the underlying SAX parser retains default behavior that permits DOCTYPE declarations, external general entities, parameter entities, or external DTD resolution.
Exploit preconditions
- Attack surface: HTTP or other application endpoints that accept XML request bodies
- Required access: The ability to send or influence an XML message parsed by the affected decoder
- Trigger point: SAX-based XML parsing of the request body
- Why exploitation is possible: Parser security features are not explicitly configured, allowing attacker-controlled XML declarations and external entity references to be resolved
Why this happens
The underlying bug is insecure XML parser configuration. A SAX parser factory is created without explicitly disabling external entity resolution, DTD loading, and related features, causing parser behavior to depend on permissive platform defaults.
This maps to CWE-611: Improper Restriction of XML External Entity Reference, where XML input can cause the parser to retrieve or expand attacker-specified external resources. The insecure pattern is applying a general-purpose XML parser to untrusted input without a deny-by-default security configuration.
Potential impact
- Local files readable by the service process may be disclosed
- The service may be used to make requests to internal or otherwise restricted network resources
- Entity expansion may consume excessive memory or CPU and cause denial of service
- Sensitive credentials, metadata, or service responses may be exposed
- Downstream systems could be affected by forged or replayed parser-generated requests
General mitigation guidance
Mitigation generally focuses on making XML parsing secure by default and reducing trust in request content.
Common defensive patterns include:
- Disable external general entities, parameter entities, external DTD loading, and DOCTYPE processing
- Use a hardened, allowlisted XML parser configuration for untrusted input
- Apply strict XML size, nesting, and processing limits
- Validate parsed content against an appropriate schema without treating validation as a substitute for parser hardening
- Restrict outbound network access from services that process XML
- Run the service with least-privilege filesystem and network permissions
- Prefer simpler data formats or constrained XML parsers where XML features are not required
How teams detect issues like this
Organizations can identify this issue through:
- Static analysis rules that flag default
SAXParserFactorycreation for untrusted XML - Code review checks for missing settings that disable external entities, DTDs, and external schema access
- Dependency and configuration reviews of XML decoder implementations
- Dynamic tests that submit XML containing external entity and DTD constructs in isolated environments
- Runtime monitoring for unexpected outbound requests or access to sensitive local paths during XML parsing
- Policy enforcement requiring hardened XML parser factories and bounded parser resource usage
Automated security review tools may help detect unsafe XML parser configuration when supported by language- and framework-aware rules.
