Server-Side Request Forgery in LogicalDOC Community Edition

Executive Summary

LogicalDOC Community Edition through version 9.3 has a server-side request forgery (SSRF) vulnerability in the default-enabled XMLConverter. Authenticated users can upload XML files with a stylesheet href pointing to internal URLs like http, ftp, file, or jar schemes without proper restrictions. This forces the server to make requests to these URLs and apply attacker-controlled XSLT during XML conversion.

Useful 0 Not Useful 0

Detection Guidance

Check for unusual outbound network requests from the LogicalDOC server, particularly to internal or unexpected hosts. Inspect XML files uploaded by users for stylesheet href attributes pointing to internal URLs (http, ftp, file, jar). Review server logs for failed or unusual XML conversion attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated access could exploit this to force the server to make internal network requests, potentially accessing sensitive data or services. The attacker could also apply malicious XSLT transformations during XML processing, leading to unauthorized actions or data exposure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the XMLConverter component if not essential. Implement strict allowlisting for XML stylesheet href URLs to block internal or unauthorized schemes. Update to a patched version if available. Restrict authenticated user permissions to limit upload capabilities.

Useful 0 Not Useful 0