Critical · published January 19, 2019
🚨 A sneaky XML External Entity Injection flaw could be lurking in your Spring Batch application! Imagine a chef who blindly trusts any recipe handed to them, without checking its source — that’s exactly what happens when your application processes untrusted XML data without proper safeguards. An attacker could craft malicious XML that exploits this vulnerability, potentially leading to unauthorized access to sensitive files or even server-side requests to internal services. It’s a recipe for disaster, opening the door for serious data leaks or service disruption.
Imagine a chef who blindly trusts any recipe handed to them, without checking its source — that’s exactly what happens when your application processes untrusted XML data without proper safeguards. This vulnerability allows attackers to inject malicious XML data, which the application processes without proper validation, enabling them to access sensitive files or services through XML External Entities (XXE).
An attacker could craft malicious XML that exploits this vulnerability, potentially leading to unauthorized access to sensitive files or even server-side requests to internal services. It’s a recipe for disaster, opening the door for serious data leaks or service disruption. Upgrade to Spring Batch version 4.2.0 or later, where this issue has been fixed. Additionally, ensure that all XML data is coming from trusted sources and implement validation checks to mitigate the risk of untrusted XML inputs. You've got this! Follow these steps and keep your application safe and sound. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| broadcom/spring_batch | ≤ 3.0.9 | — |
| broadcom/spring_batch | ≥ 4.0.0, ≤ 4.0.1 | — |
| broadcom/spring_batch | all versions | — |