mapfish-print GeoToolsLayer XXE Fix & PoC

Vulnerability Key Information Summary Vulnerability Overview Type: XXE (XML External Entity) vulnerability Location: method in within the project Cause: External entity resolution was not disabled when parsing XML data, allowing an attacker to construct malicious XML to read local files or trigger SSRF Scope of Impact Affected Files: - - - Affected Versions: Versions prior to commit Impact: May lead to arbitrary file read, SSRF, and Denial of Service (DoS) Fix Solution Core Fix: Configure in the method to disable external entity resolution: Test Coverage: Added a new test case , using the malicious GML file to verify the fix POC / Exploit Code Malicious GML File ( ) Test Case ( ) ```java @Test public void testXxePayload() throws Exception { final String host = "center.gml.flexible-scale.com"; input = ".contains(host) createXmlReader(uri -> "map-data" + uri.getUri()); final Configuration config = configurationFactory.getConfiguration(BASE_DIR + "config.yaml"); final Template template = config.getTemplate("main"); JsonObject requestData = loadJsonRequestFile(); final JsonObject gmtLayer = requestData .getJsonObject("attributes") .getJsonObject("layers") .getJsonObject("map") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJsonObject("layers") .getJson

Goal Reached Thanks to every supporter — we hit 100%!

mapfish-print GeoToolsLayer XXE Fix & PoC

More from this source