CVE-2017-12621

Vulnerability

Apache Commons Jelly before version 1.0.1 is vulnerable to XML External Entity (XXE) attacks during parsing of Jelly XML files. When a custom doctype entity is declared with a "SYSTEM" entity containing a URL and that entity is used in the Jelly file, the parser attempts to connect to the URL [1][3]. This occurs when using Apache Xerces as the underlying XML parser [1].

Exploitation

An attacker can craft a Jelly XML file with a malicious doctype declaration that defines an external entity pointing to an attacker-controlled URL. If a victim or system parses this file (e.g., via a web application that processes user-uploaded Jelly files), the parser will attempt to fetch the URL, potentially leaking sensitive data or performing other XXE-based actions [3]. No authentication is required if the parser processes untrusted content.

Impact

Successful exploitation allows a remote attacker to conduct XML external entity attacks, leading to disclosure of system information, user information, or other sensitive data [3]. The impact is limited to the privileges of the process parsing the Jelly file.

Mitigation

The vulnerability is fixed in Apache Commons Jelly version 1.0.1 [3][4]. Users should upgrade to this version or later. No workaround is available for earlier versions. The fix was released in September 2017.