CVE-2012-1102
📋 TL;DR
CVE-2012-1102 is an XML External Entity (XXE) vulnerability in XML::Atom Perl module versions before 0.39. It allows attackers to read protected files on the server when parsing untrusted XML. Affected systems include any Perl applications using vulnerable XML::Atom versions to process XML from untrusted sources.
💻 Affected Systems
- XML::Atom Perl module
📦 What is this software?
\ by Xml\
⚠️ Risk & Real-World Impact
Worst Case
Complete server file system disclosure including sensitive configuration files, credentials, and system files leading to full compromise.
Likely Case
Limited file read access depending on application context and server permissions, potentially exposing application configuration or user data.
If Mitigated
No impact if XML parsing is restricted to trusted sources or external entities are disabled via other means.
🎯 Exploit Status
XXE exploitation is well-documented and requires minimal attacker skill when application processes attacker-controlled XML.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.39 and later
Vendor Advisory: https://metacpan.org/release/MIYAGAWA/XML-Atom-0.39/source/Changes
Restart Required: No
Instructions:
1. Update XML::Atom using CPAN: 'cpan XML::Atom'
2. Or install specific version: 'cpan MIYAGAWA/XML-Atom-0.39.tar.gz'
3. Verify installation with 'perl -MXML::Atom -e 'print $XML::Atom::VERSION'
🔧 Temporary Workarounds
Disable external entities in XML parsing
allConfigure XML parser to disable external entity expansion before parsing untrusted XML
$parser->no_xxe(1); # Set before parsing
Input validation and sanitization
allValidate and sanitize XML input before processing, reject XML containing external entity declarations
🧯 If You Can't Patch
- Implement strict input validation to reject XML containing DOCTYPE or external entity declarations
- Use network segmentation to restrict XML processing services from accessing sensitive internal resources
🔍 How to Verify
Check if Vulnerable:
Check XML::Atom version with: perl -MXML::Atom -e 'print "Vulnerable" if $XML::Atom::VERSION < 0.39'Check Version:
perl -MXML::Atom -e 'print $XML::Atom::VERSION'Verify Fix Applied:
Verify version is 0.39 or higher: perl -MXML::Atom -e 'print $XML::Atom::VERSION'📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from XML parsing processes
- XML parsing errors containing file paths
Network Indicators:
- XML payloads containing external entity declarations in HTTP requests
SIEM Query:
source="web_logs" AND (http_request CONTAINS "<!ENTITY" OR http_request CONTAINS "SYSTEM")