CVE-2020-25911

Vulnerability

A XML External Entity (XXE) vulnerability exists in the modRestServiceRequest component of MODX CMS 2.7.3. The component processes incoming XML requests without disabling external entity loading, allowing an attacker to exploit the XML parser's default behavior of resolving external entities [1][3].

Exploitation

An attacker can send a crafted HTTP request to the modRestServiceRequest endpoint with a malicious XML payload containing external entity references. No authentication is required. The attack can be performed by including an external entity DTD that points to a local file or to a resource that causes excessive CPU/memory consumption [1].

Impact

Successful exploitation leads to information disclosure by reading arbitrary files from the server (e.g., configuration files with credentials) or denial of service through resource exhaustion or infinite entity expansion [1].

Mitigation

The vulnerability is fixed by commit in pull request #15238 [4]. The fix introduces a configuration option xmlDisableEntityLoader and uses libxml_disable_entity_loader() when loading XML in _collectRequestParameters(). Users should upgrade to a version of MODX Revolution that includes this commit (later than 2.7.3). If upgrading is not possible, a workaround is to ensure that the modRestServiceRequest endpoint is not exposed to untrusted sources [4].