You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@lucene.apache.org by "nts0n (via GitHub)" <gi...@apache.org> on 2026/01/22 09:18:47 UTC
[I] XXE (XML External Entity) Vulnerability in XML Parsing [lucene]
nts0n opened a new issue, #15602:
URL: https://github.com/apache/lucene/issues/15602
### Description
After reviewing the latest Apache Lucene source code (version 10.3.2), in DOMUtils.java, line 197, the application parses XML documents using a DOM parser without explicitly disabling external entity references. This insecure configuration may allow XML External Entity (XXE) attacks if user-controlled XML input is processed.
<img width="928" height="802" alt="Image" src="https://github.com/user-attachments/assets/4f53f3d2-14ae-4fc2-ba0d-c2ff69e11956" />
A sample test case was implemented using the loadXML function to evaluate XXE behavior. The function processed a malicious XML payload containing an external entity, resulting in the disclosure of the referenced local file contents.
<img width="1139" height="512" alt="Image" src="https://github.com/user-attachments/assets/7906a665-3e2d-40e5-bee1-6ec95e509d66" />
<img width="1124" height="167" alt="Image" src="https://github.com/user-attachments/assets/fd396a9d-7de3-475a-9dd9-b079771d5091" />
### Version and environment details
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
Re: [I] XXE (XML External Entity) Vulnerability in XML Parsing [lucene]
Posted by "romseygeek (via GitHub)" <gi...@apache.org>.
romseygeek closed issue #15602: XXE (XML External Entity) Vulnerability in XML Parsing
URL: https://github.com/apache/lucene/issues/15602
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
Re: [I] XXE (XML External Entity) Vulnerability in XML Parsing [lucene]
Posted by "romseygeek (via GitHub)" <gi...@apache.org>.
romseygeek commented on issue #15602:
URL: https://github.com/apache/lucene/issues/15602#issuecomment-3783391864
Thanks for opening @nts0n. This has already been fixed by https://github.com/apache/lucene/pull/15234 and the method removed entirely from upcoming releases.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org