CVE-2018-1000822
📋 TL;DR
This XXE vulnerability in codelibs fess allows attackers to read sensitive files, cause denial of service, perform SSRF attacks, and scan internal network ports by uploading specially crafted GSA XML files. It affects all fess installations before commit faa265b that process GSA XML files. Users of vulnerable fess versions are at risk of data exposure and system compromise.
💻 Affected Systems
- codelibs fess
📦 What is this software?
Fess by Codelibs
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including reading sensitive files like /etc/passwd, performing SSRF attacks against internal services, port scanning internal networks, and causing denial of service through resource exhaustion.
Likely Case
Data exfiltration of sensitive configuration files and internal service enumeration through SSRF attacks.
If Mitigated
Limited impact if XML parsing is disabled or proper input validation is implemented.
🎯 Exploit Status
Exploitation requires ability to upload or process GSA XML files. Public proof-of-concept exists demonstrating file read capabilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit faa265b and later
Vendor Advisory: https://github.com/codelibs/fess/issues/1851
Restart Required: Yes
Instructions:
1. Update fess to commit faa265b or later. 2. Pull latest changes from repository. 3. Rebuild and redeploy fess. 4. Restart fess service.
🔧 Temporary Workarounds
Disable GSA XML file processing
allTemporarily disable processing of GSA XML files until patch can be applied
Modify fess configuration to disable GSA XML parser
Implement XML input validation
allConfigure XML parser to disable external entity processing
Set XML parser properties: FEATURE_SECURE_PROCESSING=true, disallow-doctype-decl=true
🧯 If You Can't Patch
- Implement strict input validation for all XML files
- Deploy network segmentation to limit fess server access to internal networks
🔍 How to Verify
Check if Vulnerable:
Check fess commit hash or version. If before faa265b, test with XXE payload in GSA XML file.Check Version:
Check fess version in admin interface or review git commit historyVerify Fix Applied:
Verify fess is running commit faa265b or later. Test with known XXE payloads to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors
- Large XML file uploads
- Requests to internal resources from fess server
Network Indicators:
- Outbound connections from fess server to internal services
- Unusual file read patterns
SIEM Query:
source="fess" AND ("XML" OR "GSA") AND (error OR exception)