Dromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity reference

Vulnerability

Description

The vulnerability resides in the XML parsing module of Dromara HuTool, a popular Java utility library. The readBySax function in XmlUtil.java uses SAXParserFactory without disabling external entity processing, leaving it susceptible to XML External Entity (XXE) attacks. Because no security features are explicitly configured, an attacker can supply a crafted XML document that references external entities [1][3].

Exploitation

Exploitation requires the attacker to control an XML document parsed by the vulnerable readBySax method. The attack is blind (no direct output), so the attacker leverages a malicious external DTD hosted on an HTTP server under their control. The DTD reads arbitrary local files (e.g., via file:// protocol) and exfiltrates the content through an out-of-band HTTP request to an attacker-controlled listener [3].

Impact

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the target system, such as configuration files or credentials, potentially leading to further compromise. The vulnerability is classified as problematic, and an exploit has been publicly disclosed [1][3].

Mitigation

HuTool versions up to and including 5.8.19 are affected. A fix is not available from the vendor, who did not respond to disclosure attempts. Users should upgrade to a patched version (if released) or manually configure the DocumentBuilderFactory or SAXParserFactory to disable external entity processing as a workaround [1][2].