CVE-2014-2053

Vulnerability

The getID3() library before version 1.9.8, as bundled in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, contains an XML External Entity (XXE) vulnerability [1][2]. The library improperly restricts XML external entity references when parsing XML-based file formats (such as Ogg, Matroska, or other media metadata) [1][4]. This allows an attacker to supply a crafted file that includes a malicious DOCTYPE declaration with external entities, which the library then processes without validation [4].

Exploitation

To exploit this vulnerability, an attacker must be able to upload or provide a specially crafted media file to an ownCloud instance or any application using the vulnerable getID3() library [2][3]. No authentication is required if the target application allows anonymous file uploads; otherwise, a valid user account may be needed. The attacker crafts a media file (e.g., an MP3, Ogg, or other supported format) that includes an XML structure with an XXE payload referencing an external file or resource [4]. When ownCloud or the application processes the file using getID3(), the XML parser expands the external entity, leading to the exploitation.

Impact

Successful exploitation allows a remote attacker to read arbitrary files from the server filesystem (e.g., configuration files, sensitive data), cause a denial of service (e.g., by consuming resources through entity expansion), or potentially achieve other impacts depending on the PHP configuration and the attacker's control over XML parsing [2]. The attack targets the web server's privileges, so file reads are limited to what the web server user can access.

Mitigation

The fix was released in getID3 version 1.9.8 and ownCloud Server versions 5.0.15 and 6.0.2 [2][4]. The commit [4] improves the handling of XML parsing to disable external entity loading by default. Users should upgrade ownCloud to version 5.0.15 or later, or 6.0.2 or later, and ensure the bundled getID3 library is updated to 1.9.8 or later [2][3]. If upgrading is not immediately possible, a workaround is to disable file uploads that require XML parsing, but this may not be practical; patching is strongly recommended.