XXE vulnerability in Eclipse JGit

Vulnerability

Overview

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class (used by the repo command) and the AmazonS3 class (implementing the experimental amazons3 git transport protocol) are vulnerable to XML External Entity (XXE) attacks. The flaw arises because these components do not properly disable DOCTYPE declarations or external entity processing when parsing XML files, allowing an attacker to inject malicious XML [1].

Exploitation and

Attack Surface

To exploit this vulnerability, an attacker must supply a crafted XML file to one of the vulnerable parsers. In the context of the repo command, this could occur when processing repository manifests. For AmazonS3, the attack can be triggered by providing a malicious XML response when the client interacts with an S3 bucket. No special authentication is necessarily required beyond the ability to cause the JGit application to parse attacker-controlled XML [1][4].

Impact

Successful exploitation can lead to information disclosure (e.g., reading local files via external entities), denial of service, or other security consequences depending on how the XML parser is configured. The vulnerability has been addressed in JGit release 7.0.1, where DOCTYPE and entity processing are explicitly disabled in both ManifestParser and AmazonS3 [4].

Mitigation

Status

Users should upgrade to Eclipse JGit 7.0.1 (or later) which contains the security fix [4]. As of the publication date, no workarounds have been detailed, and the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.