Summary
An XML External Entity (XXE) vulnerability in Apache Camel Quarkus XSLT support allows attacker-controlled XML to reference local files or internal network resources during transformation. The issue becomes risky when XML reaches the transformer as a javax.xml.transform.Source, or when application code obtains the affected Xalan-backed JAXP default factory.
Affected context
The vulnerability occurs in applications using the Camel Quarkus XSLT support extension, including deployments that bring it onto the classpath through XSLT, Saxon, Tika, or XML security extensions. On the XSLT component path, exposure depends on message bodies reaching the transformer as a javax.xml.transform.Source; other body types are converted with external entity and external DTD loading disabled. The extension can also register an Xalan-backed TransformerFactory as the JAXP default, affecting unrelated code that obtains a factory through TransformerFactory.newInstance().
Exploit preconditions
- Attack surface: XML transformation or other application code using the JAXP default
TransformerFactory - Required access: Ability to supply or influence the XML document being transformed
- Trigger point: Parsing or transforming XML containing an external entity reference
- Why exploitation is possible: The registered Xalan-J factory does not honor the external DTD and stylesheet restrictions applied by newer JAXP-aware factories, allowing external resource resolution
Why this happens
The underlying issue is improper restriction of XML external entity references, mapped to CWE-611. Apache Camel applies external-access restrictions to the transformer factory it creates, but the Xalan-backed factory supplied by the extension predates the relevant JAXP controls and does not enforce them. Registering that factory as the JAXP default allows XML processing paths to resolve external entities unless they independently disable external resource access.
Potential impact
- Local files or other accessible resources may be disclosed
- The application may issue requests to internal network locations
- Cloud or service metadata endpoints could be probed where network access permits
- Sensitive information may be exposed through transformation results or error behavior
- Internal services may be reached from the application's network position
General mitigation guidance
Mitigation generally focuses on preventing external resource resolution throughout every XML processing path.
Common defensive patterns include:
- Use XML parsers and transformer factories that reliably enforce restricted external DTD and stylesheet access
- Disable external entities, external DTD loading, and network access by default
- Prefer explicitly configured, application-owned factories over globally registered defaults
- Validate XML sources and transformation inputs against an allowlisted schema or format
- Reduce input trust by accepting only required XML structures and rejecting unexpected declarations
- Apply least-privilege filesystem and network permissions to transformation workloads
- Keep sensitive local files and internal services inaccessible from the application where practical
How teams detect issues like this
Organizations can identify this class of issue through:
- Static analysis rules for XML parsers or transformers that leave external entity resolution enabled
- Code review checks for
TransformerFactory.newInstance()and globally registered factories - Tests that verify external DTDs, entities, stylesheets, and network retrieval are rejected
- Dependency and classpath analysis to identify XML libraries that override JAXP defaults
- Runtime policy monitoring for unexpected file reads or outbound requests during XML transformation
- CI security policies requiring explicit safe XML-processing configuration
Automated code review and software composition analysis tools may help identify unsafe parser settings and conflicting XML-provider registrations.
