CVE-2020-25020
📋 TL;DR
CVE-2020-25020 is an XML External Entity (XXE) vulnerability in MPXJ library versions through 8.1.3. It allows attackers to read arbitrary files from the server filesystem or conduct server-side request forgery attacks by parsing malicious project files. This affects any application using MPXJ's GanttProjectReader or PhoenixReader components to process untrusted project files.
💻 Affected Systems
- MPXJ library
- Applications using MPXJ GanttProjectReader
- Applications using MPXJ PhoenixReader
📦 What is this software?
Mpxj by Mpxj
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary file read leading to credential theft, followed by lateral movement and data exfiltration.
Likely Case
Sensitive file disclosure (configuration files, credentials, source code) from the server hosting the vulnerable application.
If Mitigated
Limited impact with proper input validation and XML parser hardening in place.
🎯 Exploit Status
XXE vulnerabilities are well-understood with many public exploit examples. Exploitation requires the application to process a malicious project file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.1.4 and later
Vendor Advisory: https://github.com/joniles/mpxj/security/advisories
Restart Required: Yes
Instructions:
1. Update MPXJ dependency to version 8.1.4 or later. 2. Update pom.xml or build.gradle to reference the patched version. 3. Rebuild and redeploy the application. 4. Restart the application server.
🔧 Temporary Workarounds
Disable XXE in XML parser
allConfigure XML parsers to disable external entity processing
Set XMLInputFactory properties: XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES(false) and XMLInputFactory.SUPPORT_DTD(false)
Input validation and filtering
allValidate and sanitize project files before processing
Implement file type validation and content inspection before passing to MPXJ readers
🧯 If You Can't Patch
- Implement strict file upload controls and only accept files from trusted sources
- Deploy web application firewall with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Check if application uses MPXJ version ≤8.1.3 and processes project files via GanttProjectReader or PhoenixReaderCheck Version:
mvn dependency:tree | grep mpxj OR gradle dependencies | grep mpxjVerify Fix Applied:
Verify MPXJ version is ≥8.1.4 in dependencies and test with known malicious project files📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from application process
- XML parsing errors with external entity references
Network Indicators:
- Outbound connections from application to unexpected internal systems
SIEM Query:
source="application.log" AND ("XXE" OR "external entity" OR "file://" OR "http://" in XML parsing context)