CVE-2019-17637
📋 TL;DR
This vulnerability in Eclipse Web Tools Platform allows XML External Entity (XXE) attacks even when external entity resolution is disabled in user preferences. When users edit or validate XML/DTD files containing malicious external entity references, local file contents can be exfiltrated to remote servers. All Eclipse Web Tools Platform users through version 3.18 are affected.
💻 Affected Systems
- Eclipse Web Tools Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Sensitive local files (including configuration files, credentials, or proprietary data) are exfiltrated to attacker-controlled servers, leading to data breach and potential lateral movement.
Likely Case
Attackers trick users into opening malicious XML files, resulting in leakage of local file contents that could contain sensitive information.
If Mitigated
With proper network segmentation and user awareness, impact is limited to isolated development environments with minimal sensitive data.
🎯 Exploit Status
Exploitation requires user interaction (opening/validating malicious XML file). XXE attacks are well-documented with established techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.19 or later
Vendor Advisory: https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571
Restart Required: Yes
Instructions:
1. Update Eclipse IDE to latest version. 2. Ensure Web Tools Platform is updated to 3.19+. 3. Restart Eclipse after update.
🔧 Temporary Workarounds
Disable XML validation
allTemporarily disable XML validation in Eclipse preferences to prevent exploitation via validation
Use external XML editor
allEdit XML/DTD files using external editors until patch is applied
🧯 If You Can't Patch
- Implement strict network egress filtering to block outbound connections from development workstations
- Educate users to never open untrusted XML/DTD files and implement file type restrictions
🔍 How to Verify
Check if Vulnerable:
Check Eclipse Help > About Eclipse > Installation Details > Installed Software for Web Tools Platform versionCheck Version:
Not applicable - check via Eclipse GUIVerify Fix Applied:
Verify Web Tools Platform version is 3.19 or higher in installed software list📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from Eclipse process
- Large file reads by Eclipse process
Network Indicators:
- HTTP requests to unusual domains from development workstations
- Outbound traffic containing file contents
SIEM Query:
process:eclipse.exe AND (destination_ip:external AND http_request) OR (file_read:*.xml AND network_egress)