CVE-2021-46365
📋 TL;DR
This vulnerability in Magnolia CMS allows attackers to perform XML External Entity (XXE) attacks by uploading a malicious XLF file through the Export function. Attackers can potentially read sensitive files from the server, perform server-side request forgery, or cause denial of service. All Magnolia CMS installations version 6.2.3 and below are affected.
💻 Affected Systems
- Magnolia CMS
📦 What is this software?
Magnolia Cms by Magnolia Cms
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through arbitrary file read, SSRF leading to internal network reconnaissance, or denial of service via entity expansion attacks.
Likely Case
Sensitive file disclosure (configuration files, credentials), limited SSRF to internal services, or application disruption.
If Mitigated
Attack blocked at perimeter with file upload restrictions; minimal impact with proper XML parser configuration.
🎯 Exploit Status
Exploitation requires crafting a malicious XLF file; public proof-of-concept available in GitHub disclosures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Magnolia CMS 6.2.4
Vendor Advisory: https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory
Restart Required: Yes
Instructions:
1. Backup your Magnolia instance. 2. Download Magnolia CMS 6.2.4 or later. 3. Follow Magnolia upgrade procedures. 4. Restart the application server.
🔧 Temporary Workarounds
Disable External Entity Processing
allConfigure XML parser to disable external entity resolution in Magnolia configuration.
Set XML parser properties: FEATURE_SECURE_PROCESSING=true, disallow-doctype-decl=true
Restrict File Uploads
allImplement strict file upload validation for XLF files in the Export function.
Configure file upload filters to validate/sanitize XLF content before processing
🧯 If You Can't Patch
- Disable the Export function entirely if not required
- Implement network segmentation and WAF rules to block malicious file uploads
🔍 How to Verify
Check if Vulnerable:
Check Magnolia version; if version is 6.2.3 or below, system is vulnerable.Check Version:
Check Magnolia admin interface or configuration files for version numberVerify Fix Applied:
Verify Magnolia version is 6.2.4 or higher; test XXE payloads are rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to Export endpoint
- XML parsing errors with external entity references
- Unexpected outbound connections from Magnolia server
Network Indicators:
- HTTP requests with crafted XLF files to /magnoliaAuthor/.export
- Outbound requests to internal IPs from Magnolia server
SIEM Query:
source="magnolia" AND (uri_path="/.export" OR message="XXE" OR message="External entity")🔗 References
- https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46365-Unsafe%20XML%20Parsing-Magnolia%20CMS
- https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46365-Unsafe%20XML%20Parsing-Magnolia%20CMS
