CVE-2025-53621
BaseFortify
Publication date: 2025-07-15
Last updated on: 2025-07-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dspace | dspace | 9.1 |
| dspace | dspace | 7.6.4 |
| dspace | dspace | 8.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-53621 is a vulnerability in DSpace where XML External Entity (XXE) injection is possible during XML parsing in import operations. Specifically, external entities are not disabled when parsing XML files during the import of archives in Simple Archive Format (SAF) or when importing metadata from external sources like ArXiv, Crossref, OpenAIRE, and Creative Commons. This allows an attacker to craft malicious XML that can cause the system to connect to attacker-controlled sites or read local files accessible by the server, potentially injecting malicious content into metadata fields. Exploitation requires an attacker to provide malicious payloads that are then trusted and imported by an administrator. The vulnerability affects all DSpace versions prior to 7.6.4, 8.2, and 9.1, and is fixed by disabling external entity processing in XML parsers and enforcing path traversal checks during import. [7]
How can this vulnerability impact me? :
This vulnerability can lead to sensitive information disclosure by allowing attackers to read arbitrary files or configurations from the server where DSpace is running. It can also cause the system to make connections to attacker-controlled sites (Server-Side Request Forgery), and malicious content can be injected into metadata fields. Exploitation requires either compromised administrator credentials or convincing an administrator to import a malicious archive. If external services used for metadata import are compromised, they can also deliver malicious XML payloads. The impact includes potential exposure of sensitive data and unauthorized network connections. [7]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of CVE-2025-53621 involves monitoring for suspicious XML import activities, especially imports using the Simple Archive Format (SAF) via the command-line or user interface. Since exploitation requires an administrator to import malicious XML, reviewing import logs for unusual or untrusted SAF archive imports is recommended. Additionally, network monitoring for unexpected outbound connections from the DSpace server to unknown external sites (potential SSRF) can help detect exploitation attempts. Specific commands are not provided in the resources, but administrators should audit import commands such as './dspace import' usage and inspect logs for anomalies. Careful inspection of SAF archives before import is advised to detect malicious payloads. [7]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading DSpace to versions 7.6.4, 8.2, or 9.1 where the vulnerability is fixed. If upgrading is not immediately possible, apply the manual patches available in the referenced GitHub pull requests (#11032 for 7.x, #11034 for 8.x, #11035 for 9.0) which implement safe XML parsing that disables external entity processing. Additionally, administrators should carefully inspect any SAF archives before importing, especially those not created by trusted users, and consider disabling affected external metadata import services (ArXiv, Crossref, OpenAIRE, Creative Commons) to prevent malicious payload delivery via their APIs. After patching or upgrading, rebuild the backend with Maven, redeploy, and restart the server to apply changes. [7, 1, 2, 3]