CVE-2021-23926
📋 TL;DR
This vulnerability in XMLBeans XML parsers allows attackers to perform XML Entity Expansion (XXE) attacks by submitting malicious XML input. It affects all applications using XMLBeans up to version 2.6.0 for XML processing. Successful exploitation could lead to denial of service or information disclosure.
💻 Affected Systems
- Apache XMLBeans
- Apache POI (uses XMLBeans)
- Apache Axis
- Any application using XMLBeans library
📦 What is this software?
Middleware Common Libraries And Tools by Oracle
View all CVEs affecting Middleware Common Libraries And Tools →
Middleware Common Libraries And Tools by Oracle
View all CVEs affecting Middleware Common Libraries And Tools →
Oncommand Unified Manager Core Package by Netapp
View all CVEs affecting Oncommand Unified Manager Core Package →
Peoplesoft Enterprise Peopletools by Oracle
Peoplesoft Enterprise Peopletools by Oracle
Peoplesoft Enterprise Peopletools by Oracle
Xmlbeans by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete system denial of service through resource exhaustion (billion laughs attack) or potential information disclosure via external entity references.
Likely Case
Application denial of service causing service disruption and potential data loss.
If Mitigated
Limited impact with proper XML parser configuration and input validation in place.
🎯 Exploit Status
XXE attacks are well-documented and easy to implement. No authentication required if XML input is accepted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: XMLBeans 2.6.1 and later
Vendor Advisory: https://issues.apache.org/jira/browse/XMLBEANS-517
Restart Required: Yes
Instructions:
1. Update XMLBeans dependency to version 2.6.1 or later. 2. Update pom.xml or build.gradle to reference fixed version. 3. Rebuild and redeploy application. 4. Restart affected services.
🔧 Temporary Workarounds
Configure XML parser securely
allManually set secure processing features on XML parsers before use
// Java code: XMLInputFactory factory = XMLInputFactory.newInstance();
factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
Input validation and filtering
allReject XML containing DOCTYPE declarations or external entity references
// Java code: if (xml.contains("<!DOCTYPE") || xml.contains("<!ENTITY")) {
throw new SecurityException("Malicious XML detected");
}
🧯 If You Can't Patch
- Implement network segmentation to isolate XML processing services
- Deploy web application firewall with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Check application dependencies for XMLBeans version ≤2.6.0. For Maven: mvn dependency:tree | grep xmlbeansCheck Version:
mvn dependency:tree | grep -i xmlbeans OR find . -name "*.jar" -exec jar tf {} \; | grep xmlbeansVerify Fix Applied:
Confirm XMLBeans version ≥2.6.1 in dependencies and test with malicious XML containing entity expansion📡 Detection & Monitoring
Log Indicators:
- Unusual memory consumption spikes during XML processing
- XML parsing errors containing entity references
- Repeated XML parsing failures
Network Indicators:
- Large XML payloads with repeated entity patterns
- XML containing !DOCTYPE or !ENTITY declarations
SIEM Query:
source="application.log" AND ("OutOfMemoryError" OR "XML parsing error") AND process="java"🔗 References
- https://issues.apache.org/jira/browse/XMLBEANS-517
- https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed%40%3Cjava-dev.axis.apache.org%3E
- https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1%40%3Cjava-dev.axis.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/06/msg00024.html
- https://poi.apache.org/
- https://security.netapp.com/advisory/ntap-20210513-0004/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://issues.apache.org/jira/browse/XMLBEANS-517
- https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed%40%3Cjava-dev.axis.apache.org%3E
- https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1%40%3Cjava-dev.axis.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/06/msg00024.html
- https://poi.apache.org/
- https://security.netapp.com/advisory/ntap-20210513-0004/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
