Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons

Vulnerability

Overview CVE-2025-53689 describes blind XML External Entity (XXE) vulnerabilities in the Apache Jackrabbit content repository implementation. The flaws reside in the jackrabbit-spi-commons and jackrabbit-core components, specifically where an unsecured DocumentBuilder is used to parse XML input when loading privileges [1][4]. The root cause is the lack of external entity expansion restrictions during XML processing, allowing an attacker to inject malicious DOCTYPE declarations [2].

Exploitation

Conditions Exploitation requires the attacker to supply crafted XML data to a vulnerable Jackrabbit instance. This can be achieved over the network without authentication if the affected service exposes endpoints that parse XML (e.g., privilege loading). Because the vulnerability is blind XXE, the attacker may not receive direct responses but can still exfiltrate data out-of-band through external connections, such as HTTP requests to an attacker-controlled server [1][2][4]. The fix ensures the DocumentBuilderFactory is properly secured by disabling external entity processing and DTDs (e.g., setting XMLConstants.ACCESS_EXTERNAL_DTD and FEATURE_SECURE_PROCESSING) [2].

Attacker

Gains A successful blind XXE attack can lead to disclosure of sensitive files from the Jackrabbit server filesystem, including configuration files containing credentials. In some scenarios, the attacker may also be able to perform Server-Side Request Forgery (SSRF) by making the vulnerable server issue requests to internal network resources [1][4]. The complete impact includes potential unauthorized access to backend systems and data exfiltration.

Mitigation

Apache has released fixed versions: Jackrabbit 2.20.17 (Java 8), 2.22.1 (Java 11), and 2.23.2 (Java 11, beta). Users running any earlier version—even those beyond official support (2.20.16 and older)—must upgrade to these patched releases to mitigate the risk [1][4]. No workarounds have been documented; applying the update is the only recommended course of action.