Blind SSRF via XML External Entity in Apicurio Registry

Executive Summary

This vulnerability exists in Apicurio Registry's ContentTypeUtil.isParsableXml() method, which creates a SAXParserFactory without enabling secure processing or disabling external entity resolution.

An attacker who has artifact-write permission, or even an unauthenticated attacker if the registry runs with default configuration, can upload a specially crafted XML document.

This crafted XML can trigger blind server-side request forgery (SSRF) by fetching external DTD/entities or cause a denial of service (DoS) through entity expansion.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to blind server-side request forgery (SSRF), allowing an attacker to make the server perform unintended requests to internal or external systems.

It can also cause denial of service (DoS) by exploiting entity expansion, potentially making the Apicurio Registry service unavailable.

The CVSS score of 8.5 indicates a high severity impact, with low attack complexity and no user interaction required.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring artifact upload requests to the Apicurio Registry, especially REST API calls like POST /apis/registry/v2/groups/{g}/artifacts where the Content-Type header is omitted or set to application/xml.

Detection involves looking for suspicious XML payloads that may contain external entity definitions or DTD declarations which could trigger SSRF or DoS attacks.

Network detection can include monitoring outbound HTTP requests initiated by the server during artifact uploads, which may indicate blind SSRF attempts.

While no specific commands are provided in the resources, typical detection commands could include using network monitoring tools like tcpdump or Wireshark to capture outbound requests from the server during artifact uploads, or using application logs to identify uploads with XML content lacking hardened parsing.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves hardening the SAXParser used in the ContentTypeUtil.isParsableXml() method by enabling secure processing features.

• Enable the 'disallow-doctype-decl' feature to prevent processing of DOCTYPE declarations.
• Enable 'secure-processing' to limit XML processing capabilities and prevent resource exhaustion.
• Disable external entity resolution to block external DTD/entity fetches that can lead to SSRF.

Additionally, restrict artifact-write permissions to trusted users and avoid running the registry with default configurations that allow unauthenticated uploads.

Useful 0 Not Useful 0